search

eduardsui / tlse

Single C file TLS 1.2/1.3 implementation, using tomcrypt as crypto library
Other
535 stars 87 forks source link

Client Certificate Request freezes handshake. #46

Closed vbickov closed 3 years ago

vbickov commented 5 years ago

Maybe this issue is related to a particular implementation on a client side.

When Client Verification is enabled like this:

tls_request_client_certificate(ctx); 
SSL_CTX_set_verify(ctx,SSL_VERIFY_PEER,(tls_validation_function)tls_default_verify);

handshake stops after the server sends tls_certificate_request(). The client just does not respond anything.

Is Client Certificate Request/Client Verification stable/tested ?

eduardsui commented 5 years ago

I don't know. Please post some working code in order to debug it. Just tested on the server, it works as expected.

vbickov commented 5 years ago

Well, the working code is pretty simple.

tls_load_private_key(ctx, pkey_buf, pkey_size);
tls_load_certificates(ctx, cert_buf, cert_size);
tls_load_root_certificates(ctx, root_buf, root_size);
//tls_request_client_certificate(ctx); 
SSL_CTX_set_verify(ctx,SSL_VERIFY_PEER,(tls_validation_function)tls_default_verify);
SSL_accept(m_ctx);

Nothing fails, but if tls_request_client_certificate(ctx) is uncommented, then client stops communication after server sent HELLO with tls_certificate_request(). I do not really have time to dig deeper. Maybe the problem is related to the client implementation. The client is proprietary, so I do not know what is going on inside.

eduardsui commented 5 years ago

Please post the entire code, for me to compile it and test it. What client are you using? I've tested it with Firefox and Chrome as clients, and it works.

eduardsui commented 5 years ago

You could try to compile it with -DDEBUG in order to see the handshake flow.

vbickov commented 5 years ago

I'm using your library to implement enhanced security for a non-web app, and handshake occurs in the middle of session. I already posted entire code related to handshake. Debug is enabled. Nothing happens after sending HELLO with tls_certificate_request(). Client is just sitting and waiting for something. I was just curious whether or not you experienced the same issue. You can close the case 'cause you won't be able to reproduce it anyway.

eduardsui commented 5 years ago

Ok. Never happened to me, but I never used client certificates in production (just for testing purposes). I will make some tests with openssl client to check it further.