SSL_get_peer_certificate giving empty certificate on Yosemite.

[Madhavi Shashi]

Hi,

I am using below code to get domain name/server name from IP address on Mac
OS X. But SSL_get_peer_certificateis returning empty certificate for
twitter and some of the https sites.
This problem I am facing from Yesterday. After Yosemite release.


Log:
----------------------------------------------------
22:33:44 SSLUtil::ConnectToServerAsync in progress  23.52.67.194
22:33:45 **** successfully connected and got file descriptor 1
22:33:45 SSLUtil::ConnectToServerAsync connect success  36
22:33:45 SSL_ERROR_WANT_READ
22:33:45 sockstate read 4
22:33:45 SOCKET_OPERATION_OK
22:33:45 SSLUtil::RetrieveNameUsingSSL certificate empty
-----------------------------------------------

Source code:

bool SSLUtil::RetrieveNameUsingSSL(int &sock , std::string &serverName)
{
    serverName="";
    SSL_library_init();
    SSL_METHOD *meth=SSLv3_method();
    SSL_CTX *sslctx=SSL_CTX_new(meth);
    if(!sslctx)
    {
        //printf("SSL_CTX_new failed");
        MCLOG("SSLUtil::RetrieveNameUsingSSL SSL_CTX_new failed ");
        //close(sock);
        return false;
    }
    SSL_CTX_set_verify(sslctx,SSL_VERIFY_NONE,NULL);
    SSL *ssl =SSL_new(sslctx);
    if(!ssl)
    {
        //printf("SSL_new failed\n"); close(sock);
        MCLOG("SSLUtil::RetrieveNameUsingSSL SSL_new failed ");
        //exit(4);
        return false;
    }
    int status=SSL_set_fd(ssl,sock);
    if(!status)
    {
        //printf("SSL_set_fd failed\n"); close(sock);
        //exit(5);
        MCLOG("SSLUtil::RetrieveNameUsingSSL SSL_set_fd failed ");
        return false;
    }

    status = SSL_connect(ssl);
    int error=SSL_get_error(ssl,status);
    //printf("Error %d\n",error);
    switch(error)
    {
        case SSL_ERROR_NONE:
            //printf("connect successful\n");
            break;
        case SSL_ERROR_ZERO_RETURN:
            //printf("peer close ssl connection \n");
            break;
        case SSL_ERROR_WANT_READ:
        case SSL_ERROR_WANT_WRITE:
        {
            time_t seconds;
            time_t future;
            time_t now;

            seconds = time(NULL);
            future = seconds + 2;

            MCLOG("SSLUtil::RetrieveNameUsingSSL Before SSL_ERROR_WANT_READ
& SSL_ERROR_WANT_WRITE");
            while(error == SSL_ERROR_WANT_READ || error ==
SSL_ERROR_WANT_WRITE)
            {
                status = SSL_connect(ssl);
                if(!WaitOnSocket(sock,TIMEOUT_SERVER))
                {
                    MCLOG("WaitOnSocket func failed");
                    break;
                }
                now = time(NULL);
                if(now > future)
                {
                    MCLOG("*** break");
                    break;
                }
                error=SSL_get_error(ssl,status);
                if(error == SSL_ERROR_NONE)
                {
                    MCLOG("SSL_ERROR_NONE");
                    break;
                }
                }
            }
            break;

        default:
            MCLOG("SSLUtil::RetrieveNameUsingSSL failed ",error);
            //printf("connect error is %d\n",error);
            break;
    }

    X509*  server_cert = SSL_get_peer_certificate (ssl);
    if (server_cert != NULL)
    {
        //MessageLog.Write("Server certificate");
        //str = X509_NAME_oneline(X509_get_subject_name(server_cert),0,0);
        X509_NAME * name = X509_get_subject_name(server_cert);
        char    str[512] = {} ;
        X509_NAME_get_text_by_NID(name, NID_commonName, str, 512);

        if(str != NULL)
        {
            serverName = str;
            //MessageLog.Write("Domain name :", str);
            //MessageLog.Write("Successfully fetched the certificate");
        }
        else
        {
            MCLOG("SSLUtil::RetrieveNameUsingSSL server name empty ");
        }

        X509_free (server_cert);
    }
    else
    {
        MCLOG("SSLUtil::RetrieveNameUsingSSL certificate empty ");
    }

    if(ssl)
    {
        error = SSL_shutdown(ssl);
        if(error == -1)
        {
            //MessageLog.Write("Failed to do SSLShutdown");
            MCLOG("SSLUtil::RetrieveNameUsingSSL SSLShutdown failed ");
        }
        // Free the SSL structure
        //MessageLog.Write("free SSL structure");
        SSL_free(ssl);
    }

    // Free the SSL_CTX structure
    if(sslctx)
    {
        SSL_CTX_free(sslctx);
    }

    return (!serverName.empty());

}

Why I am getting empty certificate?? I tried adding cipher
"SSL_set_cipher_list(ssl,"SSL_RSA_WITH_RC4_128_SHA);


Thanks and Regards,
Madhavi G.