[openssl-users] Hardware client certificates moving to Centos 7

[Stuart Marsden]

Hi

I have Centos/Apache servers for securely provisioning IP phones using hardware client certificates embedded in the phones.

for this test I have allowed all protocols and ciphers

on Centos 6 this works fine, the rpms are:

openssl098e-0.9.8e-20.el6.centos.1.x86_64
openssl-1.0.1e-57.el6.x86_64
openssl-devel-1.0.1e-57.el6.x86_64

on centos 7 the rpms are:

openssl098e-0.9.8e-29.el7.centos.3.x86_64
openssl-1.0.2k-8.el7.x86_64
openssl-libs-1.0.2k-8.el7.x86_64
xmlsec1-openssl-1.2.20-7.el7_4.x86_64
openssl-devel-1.0.2k-8.el7.x86_64

on Centos 7 the logging with "Loglevel debug"  in the apache config file is a lot less than Centos 6


The SSL fails to establish with the error below:


ssl_engine_kernel.c(1890): [client XX.XX.31.200:47576] AH02043: SSL virtual host for servername xxxxxxxx found

ssl_engine_kernel.c(1360): [client XX.XX.31.200:47576] AH02275: Certificate Verification, depth 1, CRL checking mode: none [subject: emailAddress=support at yealink.com,CN=Yealink Equipment Issuing CA,OU=yealink.com,O=Yealink Network Technology Co.\\,Ltd.,L=Xiamen,ST=Fujian,C=CN / issuer: emailAddress=support at yealink.com,CN=Yealink Equipment Issuing CA,OU=yealink.com,O=Yealink Network Technology Co.\\,Ltd.,L=Xiamen,ST=Fujian,C=CN / serial: E17F3D266C47321E / notbefore: Nov  7 12:45:52 2013 GMT / notafter: Nov  7 12:45:52 2033 GMT]

ssl_engine_kernel.c(1360): [client xx.xx.31.200:47576] AH02275: Certificate Verification, depth 0, CRL checking mode: none [subject: emailAddress=support at yealink.com,CN=001565c8be6f,OU=Yealink Equipment,O=Yealink Network Technology Co.\\,Ltd.,L=Xiamen,ST=Fujian,C=CN / issuer: emailAddress=support at yealink.com,CN=Yealink Equipment Issuing CA,OU=yealink.com,O=Yealink Network Technology Co.\\,Ltd.,L=Xiamen,ST=Fujian,C=CN / serial: 303031353635633862653666 / notbefore: Mar  1 00:00:00 2014 GMT / notafter: Feb 24 00:00:00 2034 GMT]

[ssl:info] [pid 1611] [client xx.xx.31.200:47576] AH02276: Certificate Verification: Error (7): certificate signature failure [subject: emailAddress=support at yealink.com,CN=001565c8be6f,OU=Yealink Equipment,O=Yealink Network Technology Co.\\,Ltd.,L=Xiamen,ST=Fujian,C=CN / issuer: emailAddress=support at yealink.com,CN=Yealink Equipment Issuing CA,OU=yealink.com,O=Yealink Network Technology Co.\\,Ltd.,L=Xiamen,ST=Fujian,C=CN / serial: 303031353635633862653666 / notbefore: Mar  1 00:00:00 2014 GMT / notafter: Feb 24 00:00:00 2034 GMT]

[ssl:info] [pid 1611] [client xx.xx.31.200:47576] AH02008: SSL library error 1 in handshake (server xxx.xxx.xxx.xxx:443)
[ssl:info] [pid 1611] SSL Library Error: error:0D0C50A1:asn1 encoding routines:ASN1_item_verify:unknown message digest algorithm
[ssl:info] [pid 1611] SSL Library Error: error:14089086:SSL routines:ssl3_get_client_certificate:certificate verify failed
[ssl:info] [pid 1611] [client xx.xx.31.200:47576] AH01998: Connection closed to child 3 with abortive shutdown


It fails across several phone vendors.

Any suggestions greatly received, thanks in advance

Stuart