search

noxxi / p5-io-socket-ssl

IO::Socket::SSL Perl Module
36 stars 59 forks source link

Bug to get client certificate #43

Closed Logioniz closed 8 years ago

Logioniz commented 8 years ago 
openssl req  -nodes -new -x509  -keyout server.key -out server.cert
openssl req  -nodes -new -x509  -keyout client.key -out client.cert

Run server

Get server from examples ss_server.pl

perl ss_server.pl -d -C server.cert -K server.key 127.0.0.1:3000

Run client

openssl s_client -connect 127.0.0.1:3000 -cert client.cert -key client.key

Server output

perl ss_server.pl -d -C server.cert -K server.key 127.0.0.1:3000
waiting for next connection.
new SSL connection without client certificate
waiting for next connection.

No client certificate

Expected behavior

Client certificate must be.

To verify that the certificate is loaded, you can replace the server with openssl

openssl s_server -cert server.cert -key server.key -accept 3000 -Verify 1
noxxi commented 8 years ago

The example server only requests a certificate from the client if option --ca is set because only then the certificate can be verified. And if no certificate is requested the client will not send one. I've updated the code to make this more clear in the usage description.

Logioniz commented 8 years ago

Thanks, with --ca option works.

Can't understand how to get client certificate without verify and not specify client CA. It is possible? So if i have my own self signed certificate which i want to check on server side. What i must to do?

noxxi commented 8 years ago

Can't understand how to get client certificate without verify and not specify client CA. It is possible?

As documented the certificate is requested if SSL_verify_mode is set to SSL_VERIFY_PEER. But the way the example programs works is that SSL_VERIFY_PEER is only used if option --ca is given. This is just an example program and not a full featured test server.

Logioniz commented 8 years ago

Oh, my question is not relevant for this example.

For example i have server with SSL_verify_mode option. How can i do client request with self signed certificate?

#!/usr/bin/perl
use Mojo::Base -strict;

use IO::Socket::SSL;
use DDP;

my $server = IO::Socket::SSL->new(
    # where to listen
    LocalAddr => '127.0.0.1',
    LocalPort => 3000,
    Listen => 10,

    # which certificate to offer
    # with SNI support there can be different certificates per hostname
    SSL_cert_file => 'tls/cert.pem',
    SSL_key_file => 'tls/key.pem',
    SSL_verify_mode => SSL_VERIFY_PEER
) or die "failed to listen: $!";

# accept client
my $client = $server->accept or die
    "failed to accept or ssl handshake: $!,$SSL_ERROR";

warn p $client->peer_certificates;

In this example i get certificate verify failed, because certificate is self signed.

Logioniz commented 8 years ago

Oh, very thanks. Found answer in your documentation. Need to set SSL_verify_callback option to validate.