Chris Zimman wrote:
>
> Starting s_server with:
>
> ./ssleay s_server -cert server.pem -CApath ./demoCA -CAfile cacert.pem -verify 1 -www
>
> SSL_accept:before SSL initalisation
> SSL_accept:SSLv3 read client hello A
> SSL_accept:SSLv3 write server hello A
> SSL_accept:SSLv3 write certificate A
> SSL_accept:SSLv3 write certificate request A
> SSL_accept:SSLv3 write server done A
> SSL_accept:SSLv3 flush data
> SSL_accept:failed in SSLv3 read client certificate A
> 6875:error:140780E1:SSL routines:SSL23_READ:ssl handshake failure:s23_lib.c:190:
>
> And then trying to connect with IE produces the usual empty available client
>certificate
> box for me.
>
>
> BUT PLEASE -- someone help tackle this client certificate issue, it is very
>frustrating.
> Like maybe a FAQ or a small client app that can successfully request a client
>certificate
> and get one back from Netscape and MSIE.
>
I've feel like I've answered this one aleph null times but maybe its
just my imagination...
When a server requests client auth it sends out a list of acceptable
CAs. With s_server in OpenSSL this list is in the file passed in the
-CAfile option it should be a PEM encoded set of acceptable CA
certificates.
With SSLeay s_server you had to string the acceptable CA certificates on
the end of the server certificate: if you look at apps/server.pem you'll
see what I mean. This was felt to be anomalous so OpenSSL uses the
-CAfile option.
Now if a browser has a client certificate but its CA is not listed when
the server makes the client cert request then you either get the blank
list (MSIE) or a message saying you haven't got any client certificates
(NS). Neither option is very informative. Version of NS before 4.06
would allow any client certificate to be selected: this didn't make much
sense either.
You can check the list of CAs sent out with by s_server with s_client.
Check if the one you want is there.
Steve.
--
Dr Stephen N. Henson. UK based freelance Cryptographic Consultant.
For info see homepage at http://www.drh-consultancy.demon.co.uk/
Email: [EMAIL PROTECTED]
NOTE NEW (13/12/98) PGP key: via homepage.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
