<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Setup of the non_fips_libctx (after help from this list a week or two ago):</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
non_fips_libctx = OSSL_LIB_CTX_new();<br>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
defp = OSSL_PROVIDER_load(non_fips_libctx, "default");<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
I also call </div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
OSSL_PROVIDER_available(non_fips_libctx, "default")</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
...to verify this worked. I only load the default provider in the non-FIPS non-default library context.</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
In case you need this info, for the fips library context, I call:</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
OSSL_LIB_CTX_load_config(fips_libctx, "/usr/local/ssl/openssl-fips.cnf")<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
With the following relevant info in openssl-fips-cnf:</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
.include /usr/local/ssl/fipsmodule.cnf
<div><br>
</div>
<div>[openssl_init]</div>
<div>providers = provider_sect</div>
<div><br>
</div>
<div># List of providers to load</div>
<div>[provider_sect]</div>
<div>default = default_sect</div>
<div># The fips section name should match the section name inside the</div>
<div># included fipsmodule.cnf.</div>
<div>fips = fips_sect</div>
<div>base = base_sect </div>
<div><br>
</div>
<div># If no providers are activated explicitly, the default one is activated implicitly.</div>
<div># See man 7 OSSL_PROVIDER-default for more details.</div>
<div>#</div>
<div># If you add a section explicitly activating any other provider(s), you most</div>
<div># probably need to explicitly activate the default provider, otherwise it</div>
<div># becomes unavailable in openssl. As a consequence applications depending on</div>
<div># OpenSSL may not work correctly which could lead to significant system</div>
<div># problems including inability to remotely access the system.</div>
<div>[default_sect]</div>
<span># activate = 1</span><br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span><br>
</span></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span>[base_sect]<br>
<span>activate = 1</span><br>
</span></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span><span><br>
</span></span></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span><span>And in fipsmodule.cnf:</span></span></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span><span><br>
</span></span></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span><span>[fips_sect]
<div>activate = 1</div>
<div>conditional-errors = 1</div>
<div>security-checks = 1</div>
<span>module-mac = E4:0D:C8:C3:1E:DB:2B:30:E6:F2:49:7B:F5:BD:10:5C:9A:2B:CC:C1:33:49:31:B5:C5:AF:50:AB:82:1E:AE:C9</span><br>
</span></span></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span><span><span><br>
</span></span></span></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span><span><span>Also verifying this worked with the following:</span></span></span></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span><span><span><br>
</span></span></span></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span><span><span>OSSL_PROVIDER_available(fips_libctx, "base")<br>
</span></span></span></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span><span><span>OSSL_PROVIDER_available(fips_libctx, "fips")<br>
</span></span></span></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span><span><span><br>
</span></span></span></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span><span><span><br>
</span></span></span></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
For setting up the trusted store, when the application starts, it calls:</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
ssl_trusted_certs = X509_STORE_new() </div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
...and then reads all of the certificates in /etc/ssl/certs/ calling </div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
X509_STORE_add_cert(trusted_store,cert);</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
..for each one.</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Then, I make the following calls to set up intermediate certs in the trust store to be treated as trust-anchors:</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
param = X509_VERIFY_PARAM_new();
<div> X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_PARTIAL_CHAIN);</div>
<div> X509_STORE_set1_param(ssl_trusted_certs, param); </div>
X509_VERIFY_PARAM_free(param);<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Then I set the store for verifying peer certs to this "global" store I created above:</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
status = SSL_CTX_set1_verify_cert_store(ctx,ssl_trusted_certs);<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
For the sake of completeness, I also call:</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
status = SSL_CTX_set1_chain_cert_store(ctx, ssl_trusted_certs);<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
...to ensure OpenSSL has access to the entire store for forming a certificate chain to present to the peer in a handshake. My application can act as a client and/or a server, and in this case, it's acting as both the client and the server, with the same SSL_CTX.
Also, this code has always worked with OpenSSL 1.1.1, which is why I was suspicious of either my library context/provider setup, or 3.0.</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Let me know if you need more info.</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Thanks,</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Jason</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Tomas Mraz <tomas@openssl.org><br>
<b>Sent:</b> Friday, November 5, 2021 1:19 PM<br>
<b>To:</b> Jason Schultz <jetson23@hotmail.com>; openssl-users@openssl.org <openssl-users@openssl.org><br>
<b>Subject:</b> Re: Establishing connection errors</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">On Fri, 2021-11-05 at 13:04 +0000, Jason Schultz wrote:<br>
> I know I've been raising a lot of issues this week, because of<br>
> varying reasons, but I've hit another one that seems like either an<br>
> OpenSSL problem, or something new/different I need to do with OpenSSL<br>
> 3.0 in connection establishment.<br>
> <br>
> To recap, I'm using two non-default library contexts, one for FIPS,<br>
> one for non-FIPS. There is an open issue in github regarding the call<br>
> to SSL_CTX_build_cert_chain(), but since the purpose of that call is<br>
> to have the server not include the root certificate when sending the<br>
> chain, I have left that out of my code for now, in order to continue<br>
> testing. It shouldn't affect what I'm trying to do.<br>
> <br>
> As far as connection set up, based on whether or not the user wants<br>
> FIPS (not using FIPS for this test), I call:<br>
> <br>
> ctx = SSL_CTX_new_ex(non_fips_libctx, NULL, TLS_method()); <br>
> <br>
> ...to set up my SSL_CTX. My understanding is that all SSL objects,<br>
> etc., created based on that SSL_CTX will use the appropriate library<br>
> context/providers. So beyond the providers and library context setup<br>
> and using SSL_CTX_new_ex(), I haven't changed any code to establish<br>
> TLS connections. I've tried to establish connections using both RSA<br>
> and ECDSA certificates/keys, self-signed, or a server cert that's<br>
> part of a chain. I'm just establishing a connection to myself, not<br>
> between two systems, just to try to get something working. I'll post<br>
> all of the handshake messages at the end of this message, but here<br>
> are the error messages I get when the client side receives the server<br>
> certificate (in this case it's a self signed RSA certificate):<br>
<br>
How do you set up the non_fips_libctx and how do you set up any<br>
certificate trust store within the SSL_CTX?<br>
<br>
-- <br>
Tomáš Mráz<br>
No matter how far down the wrong road you've gone, turn back.<br>
Turkish proverb<br>
[You'll know whether the road is wrong if you carefully listen to your<br>
conscience.]<br>
<br>
<br>
</div>
</span></font></div>
</div>
</body>
</html>