<div dir="ltr">Hi Andreas,<div><br></div><div>Below repo has examples to use OpenSSL for mTLS (mutual certificate authentication) with sample certificates. You can refer this.</div><div><br></div><div><a href="https://github.com/TalkWithTLS/TalkWithTLS/blob/master/src/sample/openssl_tls13_server_both_auth.c">https://github.com/TalkWithTLS/TalkWithTLS/blob/master/src/sample/openssl_tls13_server_both_auth.c</a><br></div><div><a href="https://github.com/TalkWithTLS/TalkWithTLS/blob/master/src/sample/openssl_tls13_client_both_auth.c">https://github.com/TalkWithTLS/TalkWithTLS/blob/master/src/sample/openssl_tls13_client_both_auth.c</a><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, May 7, 2020 at 12:36 AM Andreas Tengicki <<a href="mailto:tengicki@autopoll.de">tengicki@autopoll.de</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hello,<br>
<br>
I can not find a working mutual-TLS server/client example on github or<br>
the whole internet. Only some example for pieces of code. Communication<br>
via socket without and with encryption (openSSL) is working, but with<br>
mTLS not. I believe that I theoretical understand mTLS, but the practice<br>
will not work.<br>
<br>
The whole (small) project is here:<br>
<a href="https://github.com/deckard-rick/mTLS-example" rel="noreferrer" target="_blank">https://github.com/deckard-rick/mTLS-example</a><br>
<br>
Server Side<br>
=========<br>
<br>
I initialize the SSL-context without errors with (sample, error handling<br>
is not in this email)<br>
<br>
SSL_CTX_set_ecdh_auto(srvCtx->ctx, 1);<br>
SSL_CTX_set_verify(srvCtx->ctx, SSL_VERIFY_PEER or<br>
SSL_VERIFY_FAIL_IF_NO_PEER_CERT, NULL);<br>
SSL_CTX_load_verify_locations(srvCtx->ctx,NULL,"../certs"); //????<br>
SSL_CTX_use_certificate_chain_file(srvCtx->ctx,<br>
"../certs/server/ca.crt");<br>
SSL_CTX_use_certificate_file(srvCtx->ctx,<br>
"../certs/server/server.crt", SSL_FILETYPE_PEM);<br>
SSL_CTX_use_PrivateKey_file(srvCtx->ctx,<br>
"../certs/server/server.key", SSL_FILETYPE_PEM);<br>
SSL_CTX_check_private_key(srvCtx->ctx);<br>
<br>
the certificates are:<br>
<br>
ca.crt: Version: 3 (0x2)<br>
Serial Number:<br>
5a:fc:74:e6:28:28:0e:df:5b:7a:50:9e:a8:18:e6:04:42:f0:fd:8d<br>
Signature Algorithm: sha256WithRSAEncryption<br>
Issuer: C = AU, ST = Some-State, O = Internet Widgits Pty Ltd, CN = 42CA<br>
Validity Not Before: May 6 09:21:23 2020 GMT Not After : May 6<br>
09:21:23 2022 GMT<br>
Subject: C = AU, ST = Some-State, O = Internet Widgits Pty Ltd, CN<br>
= 42CA<br>
<br>
server.crt: Version: 1 (0x0)<br>
Serial Number:<br>
5f:6f:44:b5:27:47:f2:d2:fe:2b:21:5b:38:7d:e5:f6:e5:d9:c1:23<br>
Signature Algorithm: sha256WithRSAEncryption<br>
Issuer: C = AU, ST = Some-State, O = Internet Widgits Pty Ltd, CN = 42CA<br>
Validity Not Before: May 6 09:30:23 2020 GMT Not After : May 6<br>
09:30:23 2021 GMT<br>
Subject: C = AU, ST = Some-State, O = Internet Widgits Pty Ltd, CN =<br>
debiandevdesktop01.sdctec.lokal<br>
<br>
debiandevdesktop01.sdctec.lokal is the FQDN of the development server<br>
<br>
Client Side<br>
=========<br>
<br>
SSL_CTX_set_ecdh_auto(ctx, 1);<br>
SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);<br>
SSL_CTX_use_certificate_chain_file(ctx, "../certs/client/ca.crt");<br>
SSL_CTX_use_certificate_file(ctx, "../certs/client/client.crt",<br>
SSL_FILETYPE_PEM);<br>
SSL_CTX_use_PrivateKey_file(ctx, "../certs/client/client.key",<br>
SSL_FILETYPE_PEM);<br>
<br>
ca.crt: (see server)<br>
<br>
client.crt: Version: 1 (0x0)<br>
Serial Number: <br>
5f:6f:44:b5:27:47:f2:d2:fe:2b:21:5b:38:7d:e5:f6:e5:d9:c1:24<br>
Signature Algorithm: sha256WithRSAEncryption<br>
Issuer: C = AU, ST = Some-State, O = Internet Widgits Pty Ltd, CN = 42CA<br>
Validity Not Before: May 6 09:35:51 2020 GMT Not After : May 6<br>
09:35:51 2021 GMT<br>
Subject: C = AU, ST = Some-State, O = Internet Widgits Pty Ltd, CN =<br>
CLIENT001<br>
<br>
Error:<br>
=====<br>
<br>
If the client connects the server there are the following errors:<br>
<br>
server:<br>
139918902234240:error:1416F086:SSL<br>
routines:tls_process_server_certificate:certificate verify<br>
failed:../ssl/statem/statem_clnt.c:1915:<br>
<br>
client:<br>
139918902234240:error:1416F086:SSL<br>
routines:tls_process_server_certificate:certificate verify<br>
failed:../ssl/statem/statem_clnt.c:1915:<br>
<br>
I think, there is a problem with the certificates. But where is the<br>
problem and why?<br>
<br>
The statement to create the certificates are in the project ./certs/<a href="http://read.me" rel="noreferrer" target="_blank">read.me</a><br>
<br>
Thanks for any help, I'm looking since days for a solution and I believe<br>
it is only a small bug.<br>
<br>
Best regards<br>
<br>
Andreas<br>
<br>
<br>
</blockquote></div>