Hello all,
I am struggling with a bit of an esoteric question and have been debugging
for days now.
Basically, I am outfitting an existing app with asio based ssl HTTPS.
Clients will have to use client authentication. Have my own root CA that
signs both client and server certs. Extensive debugging using OpenSSL's
s_client and s_server tools shows that the certificate trust chain etc is
OK.
Server side works fine with browsers, requests client certificate from
browsers and only allows access if present. Alas, I can't get the client
side to work.
in boost 1.43 asio did not yet have any verification callbacks but it does
have this:
m_ssl_context.set_options(
asio::ssl::context::tlsv1_client
| asio::ssl::context::default_workarounds
);
m_ssl_context.set_verify_mode( asio::ssl::context::verify_peer );
m_ssl_context.load_verify_file( myrootca );
m_ssl_context.use_certificate_file( myclient_cert,
asio::ssl::context::pem );
m_ssl_context.use_private_key_file( myclient_key, asio::ssl::context::pem
);
When I debug this using openssl s_server I see the connection failing with
this message:
...
SSL_accept:SSLv3 write certificate request A
SSL_accept:SSLv3 flush data
read from -0x7ff81be0 [-0x7ff8e2dd] (5 bytes => 5 (0x5))
0000 - 16 03 01 00 07 .....
read from -0x7ff81be0 [-0x7ff8e2d8] (7 bytes => 7 (0x7))
0000 - 0b 00 00 03 ....
0007 -