> From: owner-openssl-us...@openssl.org On Behalf Of Amar Patel
> Sent: Thursday, 10 March, 2011 18:18
<snip: s_client receives alert 48 unknown CA, log includes:>
> Server certificate
> subject=/C=US/ST=Florida/L=Orlando/O=Company XYZ/OU=MyApp/CN=MyApp
Manager Server
> issuer=/C=US/ST=Florida/L=Orlando/O=Company XYZ/OU=MyApp/CN=MyApp CA
> ---
> Acceptable client certificate CA names
> /C=US/ST=Florida/L=Orlando/O=Company XYZ/OU=MyApp/CN=MyApp Client CA
> ---
> In the server, I have the following code:
> certificateFile = /opt/openssl-1.0.0a/ssl/certwork/server.crt
> privatKeyFile = /opt/openssl-1.0.0a/ssl/certwork/server.key
> ctx = Ctx::client_server(certificateFile, privateKeyFile);
> ctx->context()->verify_mode = SSL_VERIFY_PEER |
> SSL_VERIFY_FAIL_IF_NO_PEER_CERT | SSL_VERIFY_CLIENT_ONCE;
> ctx->context()->client_CA = SSL_load_client_CA_file
> ("/opt/openssl-1.0.0a/ssl/certwork_client/ca.crt");
>
> The context() calls methods in OpenSSL's ssl.h.
> I created the server CA (certificate authority) and
> server certificates with the following commands:
> cd /opt/openssl-1.0.0a/ssl
> mkdir certwork
> chmod 600 certwork
> cd certwork
> openssl genrsa -des3 -out ca.key 4096
> openssl req -new -x509 -days 365 -key ca.key -out ca.crt
> openssl genrsa -des3 -out server.key 4096
> openssl req -new -key server.key -out server.csr
> openssl x509 -req -days 365 -in server.csr -CA ca.crt -CAkey ca.key
> -set_serial 01 -out server.crt
> I created the client CA and client certificates with the following
commands:
> cd /opt/openssl-1.0.0a/ssl
> mkdir certwork_client
> chmod 600 certwork_client
> cd certwork_client
> openssl genrsa -des3 -out ca.key 4096
> openssl req -new -x509 -days 365 -key ca.key -out ca.crt
> openssl genrsa -des3 -out client.key 4096
> openssl req -new -key client.key -out client.csr
> openssl x509 -req -days 365 -in client.csr -CA ca.crt -CAkey ca.key
> -set_serial 01 -out client.crt
That looks reasonable. (You *can* issue both server and client
from one CA if you want, but if you want different CAs, either
for real or for a test, that's perfectly valid.)
You do realize discrete 4096 is overkill, especially for 1 year;
NIST allows 2048 for I think it's 20 years or so, last I looked.
> I can get server-side authentication to work via certificates,
> but when I add client-side authentication using certificates, I get
> "tlsv1 alert unknown ca:s3_pkt.c:1193:SSL alert number 48" error.
> I setup the client to use the server's CA
> (/opt/openssl-1.0.0a/ssl/certwork/ca.crt) and
> I setup the server to use the client's CA file
> (/opt/openssl-1.0.0a/ssl/certwork_client/ca.crt).
> What am I missing?
Did you set the server to use client/ca.crt BOTH as verify_location
AND as client_CA[_list]? These are separate. The first is REQUIRED
to verify the cert presented by the client, if any (and if none
and FAIL_IF_NO_PEER_CERT is set as you show, it fails). The second
is optional and tells the client what CA(s) the server would like,
but an OpenSSL client ignores this preference and presents whatever
it is configured to (and if the server doesn't like it, too bad).
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List openssl-users@openssl.org
Automated List Manager majord...@openssl.org
