Certificate Chain Error

2002-08-26 Thread Ron . Flolid

I'm trying to access a secured page via ssl with a client side certificate
and receive the verify error:num=19:self signed certificate in certificate
chain message when I try to validate the certificate from the client using
a standard openssl s_client command. (I've provided the syntax used and the
output below.) My goal is to use the LWP libs along with the Crypt::SSLeay
to access the secured page, but apparently my client verification is not
succeeding as indicated when the s_client command is invoked. The platform
used is HPUX 10.2 with OpenSSL version 0.9.6d. I have tried other release
with similar results. I can validate the client certificate against the CA
and that appears to work fine, so could someone tell me why this is failing
and what might be suggested to alleviate the problem.

As always, thanks for the help.

s_client command and output:

openssl s_client -connect memberplusone.deluxe.com:443 -cert cert.pem -key
key.pem -state
CONNECTED(0003)
SSL_connect:before/connect initialization
SSL_connect:SSLv2/v3 write client hello A
SSL_connect:SSLv3 read server hello A
depth=1 /C=US/O=RSA Data Security, Inc./OU=Secure Server Certification
Authority
verify error:num=19:self signed certificate in certificate chain
verify return:0
SSL_connect:SSLv3 read server certificate A
SSL_connect:SSLv3 read server certificate request A
SSL_connect:SSLv3 read server done A
SSL_connect:SSLv3 write client certificate A
SSL_connect:SSLv3 write client key exchange A
SSL_connect:SSLv3 write certificate verify A
SSL_connect:SSLv3 write change cipher spec A
SSL_connect:SSLv3 write finished A
SSL_connect:SSLv3 flush data
SSL3 alert read:fatal:certificate unknown
SSL_connect:failed in SSLv3 read finished A
5408:error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate
unknown:s3_pkt.c:1031:SSL alert number 46
5408:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake
failure:s23_lib.c:226:


__
OpenSSL Project http://www.openssl.org
User Support Mailing List[EMAIL PROTECTED]
Automated List Manager   [EMAIL PROTECTED]



Re: SSL.PM question

2002-01-28 Thread Ron . Flolid


Thanks for the response and your suggestion was essentially what I had
added to the SSL.pm module to get around the problem. I guess that my
wording of the problem made it appear that I was asking the significance of
the uninitiated variable, but I was really trying to understand why the
SSL.pm was coded to require a proxy when in most cases a proxy is not used.
Again, thanks for your great reply.




Keary Suska [EMAIL PROTECTED]@openssl.org on 01/24/2002 03:14:20 PM

Please respond to [EMAIL PROTECTED]

Sent by:  [EMAIL PROTECTED]


To:   OpenSSL [EMAIL PROTECTED]
cc:
Subject:  Re: SSL.PM question


on 1/23/02 7:07 PM, [EMAIL PROTECTED] purportedly said:

 On Wed, 23 Jan 2002 [EMAIL PROTECTED] wrote:

 I'm using SSLeay along with Open SSl to retrieve https pages via SSL.pm.
 I'm not using a proxy, but in the runtime I get the familiar
unitialized
 variable message being displayed for a line in SSL.pm. I normally like
to
 keep my executions clean and don't want uninit messages from coming
up,
 so I would like to resolve this problem. I'm using 2.75 SSL.pm and the
 error is coming from line 363 $proxy_server =~ s|^https?://||i; First,
I
 haven't a clue as to what this statement is doing from the syntax.
 I'm guessing that it is doing a pattern search but the | are
 throwing me off. I too see from the code that it is trying to parse
 HTTPS_PROXY key value from the ENV hash. I put a value into the key
 value, (i.e. HTTPS_PROXY) but I still get the unit message. Could
 someone be so kind as to tell me what the statement is doing and how I
 might eliminate the message. Yes, I do know that I could remove -w
 on the execution to suppress the message.

 This line is attempting a substitution -- the | characters are the
 regular expression delimiters (Perl is quite liberal in what characters
 are used in this context).  The 'http' (with optional 's') and '://' are
 being replaced by a null string.  The trailing 'i' indicates ignore
 case.  So it is actually stripping the protocol information from the
URL.
 The complaint is probably coming from the variable $proxy_server not
being
 properly defined somewhere before this line, hence it cannot be bound to
 the substitution operator.

Actually, that is not exactly the issue. Perl has no problem using the
variable, that's why it is issuing a warning instead of an error. The
warning message is a very common one. It means that an operation is being
performed on a variable that has a currently undefined value. Since Perl
doesn't initialize variables on declaration, this has to be done manually.
You can search the code for where $proxy_server is declared (by a my(),
local(), or our() statement), and right after it initialize it to an empty
value:
$proxy_server = '';

That will remove the warning message. However, you should be aware that the
code may expect the value to be undefined under certain circumstances. You
may want to search for a call to defined on that variable. If you find
one, you should change the troublesome line of code to:
$proxy_server =~ s|^https?://||i if defined $proxy_server;
and *not* initialize the variable as specified above. On second thought,
you
should do this anyway, as it is much safer overall.

Keary Suska
Esoteritech, Inc.
Leveraging Open Source for a better Internet

__
OpenSSL Project http://www.openssl.org
User Support Mailing List[EMAIL PROTECTED]
Automated List Manager   [EMAIL PROTECTED]



__
OpenSSL Project http://www.openssl.org
User Support Mailing List[EMAIL PROTECTED]
Automated List Manager   [EMAIL PROTECTED]



SSL.PM question

2002-01-23 Thread Ron . Flolid

I'm using SSLeay along with Open SSl to retrieve https pages via SSL.pm.
I'm not using a proxy, but in the runtime I get the familiar unitialized
variable message being displayed for a line in SSL.pm. I normally like to
keep my executions clean and don't want uninit messages from coming up,
so I would like to resolve this problem. I'm using 2.75 SSL.pm and the
error is coming from line 363 $proxy_server =~ s|^https?://||i; First, I
haven't a clue as to what this statement is doing from the syntax. I'm
guessing that it is doing a pattern search but the | are throwing me off.
I too see from the code that it is trying to parse HTTPS_PROXY key value
from the ENV hash. I put a value into the key value, (i.e. HTTPS_PROXY) but
I still get the unit message. Could someone be so kind as to tell me what
the statement is doing and how I might eliminate the message. Yes, I do
know that I could remove -w on the execution to suppress the message.

Thanks in advance for any help.

__
OpenSSL Project http://www.openssl.org
User Support Mailing List[EMAIL PROTECTED]
Automated List Manager   [EMAIL PROTECTED]