I tested by openssl s_client, it seems work. openssl client correctly
listed 21 certificate authorities, and return no client certificate. I
setup the server to ignore this no cert error, and everything works as
expected. Any suggestions? It looks more like a web browser problem.
Thanks.
-Zhong
ssludmp output:
1 1 0.0100 (0.0100) C>S SSLv2 compatible client hello
Version 3.1
cipher suites
TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
SSL2_CK_3DES
TLS_DHE_DSS_WITH_RC4_128_SHA
TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_RC4_128_MD5
SSL2_CK_RC2
SSL2_CK_RC4
SSL2_CK_RC464
TLS_DHE_DSS_WITH_RC2_56_CBC_SHA
TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA
TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5
TLS_RSA_EXPORT1024_WITH_RC4_56_MD5
TLS_DHE_RSA_WITH_DES_CBC_SHA
TLS_DHE_DSS_WITH_DES_CBC_SHA
TLS_RSA_WITH_DES_CBC_SHA
SSL2_CK_DES
TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
TLS_RSA_EXPORT_WITH_DES40_CBC_SHA
TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5
TLS_RSA_EXPORT_WITH_RC4_40_MD5
SSL2_CK_RC2_EXPORT40
SSL2_CK_RC4_EXPORT40
1 2 0.1400 (0.1300) S>C Handshake
ServerHello
Version 3.1
session_id[32]=
71 16 0a c1 db 72 c8 eb 81 1b af 93 3a f3 a5 eb
b9 c0 33 54 96 0a 7e 45 4a b4 f0 aa 08 eb 35 92
cipherSuite TLS_RSA_WITH_RC4_128_SHA
compressionMethod NULL
1 3 0.1400 (0.0000) S>C Handshake
Certificate
Error: short handshake length: expected 3434 got 3068
Error: short handshake length: expected 7303785 got 366
1 4 0.1400 (0.0000) S>C Handshake1 5 0.2100 (0.0700) S>C
Handshake1 6 0.2
100 (0.0000) C>S Handshake
Certificate
1 7 0.2100 (0.0000) C>S Handshake
ClientKeyExchange
1 8 0.2100 (0.0000) C>S ChangeCipherSpec
1 9 0.2100 (0.0000) C>S Handshake
1 10 0.4200 (0.2100) S>C ChangeCipherSpec
1 11 0.4200 (0.0000) S>C Handshake
openssl output:
$ openssl s_client -connect 10.0.67.33:443
CONNECTED(00000003)
depth=0 /C=US/ST=Dreamland/L=Imaginary/O=Illusionary Company
Inc/OU=Exaggerated
Department/CN=www.512key.delusionalfalsehood.org/Email=noone@delusionalf
alsehood
.org
verify error:num=18:self signed certificate
verify return:1
depth=0 /C=US/ST=Dreamland/L=Imaginary/O=Illusionary Company
Inc/OU=Exaggerated
Department/CN=www.512key.delusionalfalsehood.org/Email=noone@delusionalf
alsehood
.org
verify return:1
---
Certificate chain
0 s:/C=US/ST=Dreamland/L=Imaginary/O=Illusionary Company
Inc/OU=Exaggerated Dep
artment/CN=www.512key.delusionalfalsehood.org/Email=noone@delusionalfals
ehood.or
g
i:/C=US/ST=Dreamland/L=Imaginary/O=Illusionary Company
Inc/OU=Exaggerated Dep
artment/CN=www.512key.delusionalfalsehood.org/Email=noone@delusionalfals
ehood.or
g
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIClzCCAkGgAwIBAgIBADANBgkqhkiG9w0BAQQFADCB0zELMAkGA1UEBhMCVVMx
EjAQBgNVBAgTCURyZWFtbGFuZDESMBAGA1UEBxMJSW1hZ2luYXJ5MSAwHgYDVQQK
ExdJbGx1c2lvbmFyeSBDb21wYW55IEluYzEfMB0GA1UECxMWRXhhZ2dlcmF0ZWQg
RGVwYXJ0bWVudDErMCkGA1UEAxMid3d3LjUxMmtleS5kZWx1c2lvbmFsZmFsc2Vo
b29kLm9yZzEsMCoGCSqGSIb3DQEJARYdbm9vbmVAZGVsdXNpb25hbGZhbHNlaG9v
ZC5vcmcwHhcNMDEwNTA5MDIxNTI3WhcNMDQwMjAzMDIxNTI3WjCB0zELMAkGA1UE
BhMCVVMxEjAQBgNVBAgTCURyZWFtbGFuZDESMBAGA1UEBxMJSW1hZ2luYXJ5MSAw
HgYDVQQKExdJbGx1c2lvbmFyeSBDb21wYW55IEluYzEfMB0GA1UECxMWRXhhZ2dl
cmF0ZWQgRGVwYXJ0bWVudDErMCkGA1UEAxMid3d3LjUxMmtleS5kZWx1c2lvbmFs
ZmFsc2Vob29kLm9yZzEsMCoGCSqGSIb3DQEJARYdbm9vbmVAZGVsdXNpb25hbGZh
bHNlaG9vZC5vcmcwXDANBgkqhkiG9w0BAQEFAANLADBIAkEA0+yKguktiZy3Iqau
skwTzeszAFsUMj1o0u3tyGFX8rPlBXoOJ5SDZSC6QUavVNE757HXCi6vN380Ge2Q
Aw4gUwIDAQABMA0GCSqGSIb3DQEBBAUAA0EAgMV4Y4Xk2OYGffuCMO8HZrCh0heN
A7KZuETXMG+ibDukIDFngzmQdo1WB+UaMzx7p3k14ISUWQV34mvuQKrKdQ==
-----END CERTIFICATE-----
subject=/C=US/ST=Dreamland/L=Imaginary/O=Illusionary Company
Inc/OU=Exaggerated
Department/CN=www.512key.delusionalfalsehood.org/Email=noone@delusionalf
alsehood
.org
issuer=/C=US/ST=Dreamland/L=Imaginary/O=Illusionary Company
Inc/OU=Exaggerated D
epartment/CN=www.512key.delusionalfalsehood.org/Email=noone@delusionalfa
lsehood.
org
---
Acceptable client certificate CA names
/C=US/ST=Dreamland/L=Imaginary/O=Illusionary Company Inc/OU=Exaggerated
Departme
nt/CN=www.512key.delusionalfalsehood.org/Email=noone@delusionalfalsehood
.org
/C=US/ST=Nowhere/L=Void/O=Non Existent Co./OU=Bogus
Org./CN=www.1024key.controve
[EMAIL PROTECTED]
/C=US/O=Digital Signature Trust Co./CN=Baltimore EZ by
DST/0.9.2342.19200300.100
[EMAIL PROTECTED]
/C=US/O=MSFT/CN=Microsoft Authenticode(tm) Root Authority
/OU=Copyright (c) 1997 Microsoft Corp./OU=Microsoft
Corporation/CN=Microsoft Roo
t Authority
/O=Microsoft Trust Network/OU=Microsoft Corporation/OU=Microsoft Time
Stamping S
ervice Root/OU=Copyright (c) 1997 Microsoft Corp.
/C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting/OU=Certification
Services
Division/CN=Thawte Personal Basic [EMAIL PROTECTED]
/C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting/OU=Certification
Services
Division/CN=Thawte Personal Freemail
[EMAIL PROTECTED]
/C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting/OU=Certification
Services
Division/CN=Thawte Personal Premium [EMAIL PROTECTED]
/C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting
cc/OU=Certification Servic
es Division/CN=Thawte Premium Server [EMAIL PROTECTED]
/C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting
cc/OU=Certification Servic
es Division/CN=Thawte Server [EMAIL PROTECTED]
/C=ZA/ST=Western Cape/L=Durbanville/O=Thawte/OU=Thawte
Certification/CN=Thawte T
imestamping CA
/C=US/O=VeriSign, Inc./OU=Class 1 Public Primary Certification Authority
- G2/OU
=(c) 1998 VeriSign, Inc. - For authorized use only/OU=VeriSign Trust
Network
/C=US/O=VeriSign, Inc./OU=Class 1 Public Primary Certification Authority
/C=US/O=VeriSign, Inc./OU=Class 2 Public Primary Certification Authority
- G2/OU
=(c) 1998 VeriSign, Inc. - For authorized use only/OU=VeriSign Trust
Network
/C=US/O=VeriSign, Inc./OU=Class 2 Public Primary Certification Authority
/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority
- G2/OU
=(c) 1998 VeriSign, Inc. - For authorized use only/OU=VeriSign Trust
Network
/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority
/C=US/O=VeriSign, Inc./OU=Class 4 Public Primary Certification Authority
- G2/OU
=(c) 1998 VeriSign, Inc. - For authorized use only/OU=VeriSign Trust
Network
/O=VeriSign Trust Network/OU=VeriSign, Inc./OU=VeriSign Time Stamping
Service Ro
ot/OU=NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.
/C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority
---
SSL handshake has read 4260 bytes and written 258 bytes
---
New, TLSv1/SSLv3, Cipher is RC4-SHA
Server public key is 512 bit
SSL-Session:
Protocol : TLSv1
Cipher : RC4-SHA
Session-ID:
71160AC1DB72C8EB811BAF933AF3A5EBB9C03354960A7E454AB4F0AA08EB3592
Session-ID-ctx:
Master-Key:
66F741A7686374A989A9BFCD2D921B83A817AAA314AE80A0F9746BB401BE6087
66A10C304754A5BD63C38D4CD737CBF3
Key-Arg : None
Start Time: 999893043
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
-----Original Message-----
From: Eric Rescorla [mailto:[EMAIL PROTECTED]]
Sent: Friday, September 07, 2001 9:20 AM
To: [EMAIL PROTECTED]
Subject: Re: failure on client auth
"Zhong Chen" <[EMAIL PROTECTED]> writes:
> I built a ssl server with client authentication on. In the server
side,
> following code was called to load CAs for client cert verification:
> SSL_CTX_add_client_CA
> X509_STORE_add_cert
> I can add upto 19 certficates, and everything works fine. But if I add
> 20 certificates, it fails (tested by IE and Netscape, both browser
> hang). ssldump shows following messages:
>
> Is it a browser problem, or my server problem?
> Thanks.
>
> ----------------------------------------------------------
> 1 1 0.0400 (0.0400) C>S Handshake
> ClientHello
> Version 3.0
> cipher suites
> SSL_RSA_WITH_RC4_128_MD5
> SSL_RSA_WITH_RC4_128_SHA
> SSL_RSA_WITH_3DES_EDE_CBC_SHA
> SSL_RSA_WITH_DES_CBC_SHA
> SSL_RSA_EXPORT1024_WITH_RC4_56_SHA
> SSL_RSA_EXPORT1024_WITH_DES_CBC_SHA
> SSL_RSA_EXPORT_WITH_RC4_40_MD5
> SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
> SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
> SSL_DHE_DSS_WITH_DES_CBC_SHA
> SSL_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA
> compression methods
> NULL
> 1 2 0.1400 (0.1000) S>C Handshake
> ServerHello
> Version 3.0
> session_id[32]=
> 5c 4d f9 73 bb 9b 7e 30 83 ba 70 7c c8 a1 27 75
> 06 1b c4 aa 17 e7 97 c8 da db be f8 2c 85 9b 4a
> cipherSuite SSL_RSA_WITH_RC4_128_MD5
> compressionMethod NULL
> 1 3 0.1400 (0.0000) S>C Handshake
> Certificate
> Error: short handshake length: expected 3434 got 3068
> Error: short handshake length: expected 7303785 got 366
> ----------------------------------------------------------------
>
> (3068 + 366 == 3434, is it a fragment problem?)
Ordinarily, I'd just say that ssldump's reassembler has gone
wonky (I see the odd error now and then so this wouldn't be
a surprise) but the fact that the handshake isn't working suggests
that something is actually wrong with the message that OpenSSL
is generating.
Can OpenSSL's client talk to this server? If not, what error
does it throw?
-Ekr
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
