I don't want to I don't know how to do this
On Tue, Oct 9, 2018, 6:06 PM Dustin Albright <dustin.albrigh...@gmail.com>
wrote:
> No had to bring in grocery sorry about that
>
> On Tue, Oct 9, 2018, 5:45 PM Jeremy Harris <j...@wizmail.org> wrote:
>
>> Hi,
>>
>> OpenSSL version 1.1.1 FIPS, on Fedora 29
>>
>> (on both client and server)
>>
>>
>> I'm seeing a client not receiving, or ignoring, what
>> should be a fatal alert from the server during handshake.
>>
>> The server is requiring a client-certificate, via:
>>
>> SSL_CTX_set_verify(sctx,
>> SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, ...)
>> ...
>> server_ssl = SSL_new(server_ctx)
>> ...
>> SSL_accept(server_ssl)
>>
>> ... and the client is not supplying one. This is a deliberate
>> testcase. The server debug output goes:
>> ==============
>> 21:31:54 8729 SMTP>> 220 TLS go ahead
>> 21:31:54 8729 Calling SSL_accept
>> 21:31:54 8729 SSL info: before SSL initialization
>> 21:31:54 8729 SSL info: before SSL initialization
>> 21:31:54 8729 SSL info: before SSL initialization
>> 21:31:54 8729 SSL info: SSLv3/TLS read client hello
>> 21:31:54 8729 SSL info: SSLv3/TLS write server hello
>> 21:31:54 8729 SSL info: SSLv3/TLS write change cipher spec
>> 21:31:54 8729 SSL info: TLSv1.3 write encrypted extensions
>> 21:31:54 8729 SSL info: SSLv3/TLS write certificate request
>> 21:31:54 8729 SSL info: SSLv3/TLS write certificate
>> 21:31:54 8729 SSL info: TLSv1.3 write server certificate verify
>> 21:31:54 8729 SSL info: SSLv3/TLS write finished
>> 21:31:54 8729 SSL info: TLSv1.3 early data
>> 21:31:54 8729 SSL info: TLSv1.3 early data
>> 21:31:54 8729 SSL info: error
>> 21:31:54 8729 SSL info: error
>> 21:31:54 8729 LOG: MAIN
>> 21:31:54 8729 TLS error on connection from (rhu.barb)
>> [192.168.122.94] (SSL_accept): error:1417C0C7:SSL
>> routines:tls_process_client_certificate:peer did not return a certificate
>> ===================
>> So far so good. The client however sees:
>> ===================
>> <<< 220 TLS go ahead
>> Attempting to start TLS
>> SSL info: before SSL initialization
>> SSL info: before SSL initialization
>> SSL info: SSLv3/TLS write client hello
>> SSL info: SSLv3/TLS write client hello
>> SSL info: SSLv3/TLS read server hello
>> SSL info: TLSv1.3 read encrypted extensions
>> SSL info: SSLv3/TLS read server certificate request
>> SSL info: SSLv3/TLS read server certificate
>> SSL info: TLSv1.3 read server certificate verify
>> SSL info: SSLv3/TLS read finished
>> SSL info: SSLv3/TLS write change cipher spec
>> SSL info: SSLv3/TLS write client certificate
>> SSL info: SSLv3/TLS write finished
>> SSL info: SSL negotiation finished successfully
>> SSL info: SSL negotiation finished successfully
>> SSL connection using TLS_AES_256_GCM_SHA384
>> =================
>>
>> The code running up to that last line indicates that
>> SSL_connect() returned without error:
>> ----
>> rc = SSL_connect (*ssl);
>> alarm(0);
>>
>> if (sigalrm_seen)
>> {
>> printf("SSL_connect timed out\n");
>> return 0;
>> }
>>
>> if (rc <= 0)
>> {
>> ERR_print_errors_fp(stdout);
>> return 0;
>> }
>>
>> printf("SSL connection using %s\n", SSL_get_cipher (*ssl));
>> ----
>>
>>
>> What am I doing wrong?
>> --
>> Thanks,
>> Jeremy
>> --
>> openssl-users mailing list
>> To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
>>
>
--
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
