<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:-apple-system;}
@font-face
{font-family:"Helvetica Neue";}
@font-face
{font-family:inherit;
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
h2
{mso-style-priority:9;
mso-style-link:"Heading 2 Char";
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:18.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.Heading2Char
{mso-style-name:"Heading 2 Char";
mso-style-priority:9;
mso-style-link:"Heading 2";
font-family:"Calibri Light",sans-serif;
color:#2F5496;}
span.EmailStyle24
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:362678696;
mso-list-template-ids:1425995546;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">[Apologies to the list for top-posting and HTML email. I'm in a hurry and don't have time to reformat.]<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">No idea who "psv sridhar" is – I don't recall ever seeing that name here on openssl-users before – but I don't see anything inappropriate about your message. Ignore him/her.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">OpenSSL is telling you that it wasn't able to verify the peer's certificate. That's probably because you haven't loaded the correct collection of trust anchors (root certificates, and possibly intermediate certificates as well).<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">You ask whether SSL_VERIFY_PEER should be set. Yes, it *must* be set, except in unusual circumstances (e.g. you're using a pre-shared key); otherwise you're vulnerable to MITM interception and have no security under any reasonable threat
model.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Your questions suggest you're not a TLS expert. TLS is <i>extremely</i> easy to get wrong (which is why a huge number of applications, particularly in the mobile space, get it wrong), so I would strongly recommend you do some research before
proceeding. There are any number of introductions to SSL/TLS online, though personally if one of my teams were starting with TLS I'd require at least one of them read a more substantial introduction, such as Rescorla's /SSL and TLS/ or Ristic's /Bulletproof
TLS/.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> openssl-users <openssl-users-bounces@openssl.org>
<b>On Behalf Of </b>Pierre-Luc Boily<br>
<b>Sent:</b> Friday, 16 December, 2022 16:20<br>
<b>To:</b> psv sridhar <psv_sridhar@yahoo.com><br>
<b>Cc:</b> openssl-users@openssl.org<br>
<b>Subject:</b> Re: How to fix "OpenSSL failed - error:0A000086:SSL routines::certificate verify failed"<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">I am asking a question regarding OpenSSL. I thought the mailing list was the place. I read this on the github page of OpenSSL<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><i> If you have questions about how to use OpenSSL for specific tasks<br>
or how to solve certain problems you have when using it, you might<br>
want to ask them on the <a href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a> mailing list.<br>
There you can get help from a great community of OpenSSL users,<br>
not only (but including) the OpenSSL developers. For more information<br>
about our mailing lists, see<br>
<a href="https://www.openssl.org/community/mailinglists.html">https://www.openssl.org/community/mailinglists.html</a>.</i><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Le ven. 16 déc. 2022, à 17 h 14, psv sridhar <<a href="mailto:psv_sridhar@yahoo.com">psv_sridhar@yahoo.com</a>> a écrit :<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Courier New"">you are sending flooded emails wrongly. stop it.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Courier New""><o:p> </o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Courier New""> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:#2D2D2D">Thanks and Regards<br>
Sridhar PSV</span></b><span style="font-size:12.0pt;font-family:"Courier New""><o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><b><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:#2D2D2D">Phone 571 244-5862</span></b><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:#2D2D2D"><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Courier New""><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Courier New""><o:p> </o:p></span></p>
</div>
</div>
<div id="m_240327057844935802ydp7972b741yahoo_quoted_1513837487">
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica Neue";color:#26282A">On Friday, December 16, 2022 at 04:08:38 PM CST, Pierre-Luc Boily <<a href="mailto:pierreluc.boily@gmail.com" target="_blank">pierreluc.boily@gmail.com</a>> wrote:
<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica Neue";color:#26282A"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica Neue";color:#26282A"><o:p> </o:p></span></p>
</div>
<div>
<div id="m_240327057844935802ydp7972b741yiv9153410716">
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica Neue";color:#26282A">Hello,<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica Neue";color:#26282A"><o:p> </o:p></span></p>
</div>
<div>
<h2 style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:8.4pt;margin-left:0in;vertical-align:baseline;font-stretch:inherit">
<u><span style="font-size:13.5pt;font-family:-apple-system;color:#232629">Details</span></u><span style="font-family:-apple-system;color:#232629"><o:p></o:p></span></h2>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica Neue";color:#26282A">OS : WIndows 10<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica Neue";color:#26282A">Arch : x64<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica Neue";color:#26282A">Compiler : VisualStudio 2017<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica Neue";color:#26282A"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:-apple-system;color:#232629">I have a <strong><span style="font-family:-apple-system;border:none windowtext 1.0pt;padding:0in">c++ wss <a href="https://github.com/machinezone/IXWebSocket" target="_blank"><span style="font-family:"inherit",serif">IXWebSocket</span></a> client</span></strong> that
tries to connect to a <strong><span style="font-family:-apple-system;border:none windowtext 1.0pt;padding:0in">nodejs https/websocket server</span></strong> but the client refuses to connect and returns the error : <em><span style="font-family:-apple-system;border:none windowtext 1.0pt;padding:0in">OpenSSL
failed - error:0A000086:SSL routines::certificate verify failed</span></em></span><span style="font-size:10.0pt;font-family:"Helvetica Neue";color:#26282A"><o:p></o:p></span></p>
</div>
<div>
<h2 style="mso-margin-top-alt:20.0pt;margin-right:0in;margin-bottom:8.4pt;margin-left:0in;vertical-align:baseline;font-stretch:inherit">
<u><span style="font-size:13.5pt;font-family:-apple-system;color:#232629;border:none windowtext 1.0pt;padding:0in">What I tried</span></u><span style="font-family:-apple-system;color:#232629;border:none windowtext 1.0pt;padding:0in"><o:p></o:p></span></h2>
<p class="MsoNormal" style="mso-margin-bottom-alt:auto;margin-left:58.5pt;text-indent:-.25in;mso-list:l0 level1 lfo1;vertical-align:baseline">
<![if !supportLists]><span style="font-size:10.0pt;font-family:"inherit",serif;color:#232629;border:none windowtext 1.0pt;padding:0in"><span style="mso-list:Ignore">1.<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span style="font-size:10.0pt;font-family:"inherit",serif;color:#232629;border:none windowtext 1.0pt;padding:0in">I have a React front end using wss to communicate to my https nodejs server. <strong><span style="font-family:"inherit",serif">It
works -></span></strong> <b>This confirms that my key and certificate are valid.</b><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:58.5pt;text-indent:-.25in;mso-list:l0 level1 lfo1;vertical-align:baseline">
<![if !supportLists]><span style="font-size:10.0pt;font-family:"inherit",serif;color:#232629;border:none windowtext 1.0pt;padding:0in"><span style="mso-list:Ignore">2.<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span style="font-size:10.0pt;font-family:"inherit",serif;color:#232629;border:none windowtext 1.0pt;padding:0in">I also tried the same c++ client above, not secured (no wss) connecting to my same nodejs server, but http/websocket
(non secure). <strong><span style="font-family:"inherit",serif">It works</span></strong>.<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:-apple-system;color:#232629;border:none windowtext 1.0pt;padding:0in">So, I had to dig into the OpenSSL code and I found where the error is triggered, see code below. In my case </span><em><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#24292F;border:none windowtext 1.0pt;padding:0in">s->verify_mode</span></em><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#24292F;border:none windowtext 1.0pt;padding:0in"> is
equal to <em><span style="font-family:"Arial",sans-serif">SSL_VERIFY_PEER</span></em> and <em><span style="font-family:"Arial",sans-serif">i</span></em> equal to <em><span style="font-family:"Arial",sans-serif">0</span></em> and I don't know if those values
are OK or not.</span><span style="font-size:10.0pt;font-family:"Helvetica Neue";color:#232629;border:none windowtext 1.0pt;padding:0in"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:-apple-system;color:#232629;border:none windowtext 1.0pt;padding:0in"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#24292F;border:none windowtext 1.0pt;padding:0in">While I was digging into the code, I also realized that <i>SSL_OP_NO_TLSv1_3</i> is automagically defined for my code.
I feel that it is incorrect</span><span style="font-size:10.0pt;font-family:-apple-system;color:#24292F;border:none windowtext 1.0pt;padding:0in">.</span><span style="font-size:10.0pt;font-family:"Helvetica Neue";color:#232629;border:none windowtext 1.0pt;padding:0in"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.5pt;font-family:-apple-system;color:#232629;border:none windowtext 1.0pt;padding:0in"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><u><span style="font-size:10.5pt;font-family:-apple-system;color:#24292F;border:none windowtext 1.0pt;padding:0in">From
</span></u></b><b><u><span style="font-size:10.5pt;font-family:"Courier New";color:blue;border:none windowtext 1.0pt;padding:0in">statem_clnt.c</span></u></b><b><u><span style="font-size:10.5pt;font-family:-apple-system;color:#24292F;border:none windowtext 1.0pt;padding:0in">
line 1888</span></u></b><span style="font-size:10.5pt;font-family:-apple-system;color:#24292F;border:none windowtext 1.0pt;padding:0in">:</span><span style="font-size:11.5pt;font-family:"Helvetica Neue";color:#26282A;border:none windowtext 1.0pt;padding:0in"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:blue;border:none windowtext 1.0pt;padding:0in"> if (s->verify_mode != SSL_VERIFY_NONE && i <= 0) {<br>
SSLfatal(s, ssl_x509err2alert(s->verify_result),<br>
SSL_R_CERTIFICATE_VERIFY_FAILED);<br>
return WORK_ERROR;<br>
}</span><span style="font-size:10.0pt;font-family:"Helvetica Neue";color:#26282A;border:none windowtext 1.0pt;padding:0in"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.5pt;font-family:-apple-system;color:#232629;border:none windowtext 1.0pt;padding:0in"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><u><span style="font-size:11.5pt;font-family:-apple-system;color:#232629;border:none windowtext 1.0pt;padding:0in">Stacktrace</span></u></b><span style="font-size:11.5pt;font-family:-apple-system;color:#232629;border:none windowtext 1.0pt;padding:0in">:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Courier New";color:#232629;border:none windowtext 1.0pt;padding:0in">>
</span><span style="font-size:7.5pt;font-family:"Courier New";color:blue;border:none windowtext 1.0pt;padding:0in">libssl-3-x64.dll!tls_post_process_server_certificate(ssl_st<br>
libssl-3-x64.dll!ossl_statem_client_post_process_message(ss<br>
libssl-3-x64.dll!read_state_machine(ssl_st * s) Line 675 <br>
libssl-3-x64.dll!state_machine(ssl_st * s, int server) Line<br>
libssl-3-x64.dll!ossl_statem_connect(ssl_st * s) Line 266 <br>
libssl-3-x64.dll!SSL_do_handshake(ssl_st * s) Line 3937 C <br>
libssl-3-x64.dll!SSL_connect(ssl_st * s) Line 1760 C <br>
testWSClient.exe!ix::SocketOpenSSL::openSSLClientHandshake(<br>
testWSClient.exe!ix::SocketOpenSSL::connect(const std::basi<br>
testWSClient.exe!ix::WebSocketHandshake::clientHandshake(co<br>
testWSClient.exe!ix::WebSocketTransport::connectToUrl(const<br>
testWSClient.exe!ix::WebSocket::connect(int timeoutSecs) Li<br>
testWSClient.exe!ix::WebSocket::checkConnection(bool firstC<br>
testWSClient.exe!ix::WebSocket::run() Line 367 C++ </span><span style="font-size:11.5pt;font-family:-apple-system;color:blue;border:none windowtext 1.0pt;padding:0in">
</span><span style="font-size:11.5pt;font-family:-apple-system;color:#232629;border:none windowtext 1.0pt;padding:0in"> </span><span style="font-size:10.0pt;font-family:"Helvetica Neue";color:#26282A;border:none windowtext 1.0pt;padding:0in"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.5pt;font-family:-apple-system;color:#232629;border:none windowtext 1.0pt;padding:0in"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><u><span style="font-size:11.5pt;font-family:-apple-system;color:#232629;border:none windowtext 1.0pt;padding:0in">IXWebClient, how key/cert are set
</span></u></b><u><span style="font-size:11.5pt;font-family:-apple-system;color:#232629;border:none windowtext 1.0pt;padding:0in">:</span></u><span style="font-size:11.5pt;font-family:-apple-system;color:#232629;border:none windowtext 1.0pt;padding:0in"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.5pt;font-family:"Courier New";color:blue;border:none windowtext 1.0pt;padding:0in">
</span><span style="font-size:10.0pt;font-family:"Courier New";color:blue;border:none windowtext 1.0pt;padding:0in"> ix::SocketTLSOptions tlsOptions;<br>
tlsOptions.certFile = "WebRTC.test.crt";<br>
tlsOptions.keyFile = "WebRTC.test.key";<br>
tlsOptions.caFile = "WebRTC-CA.pem";<br>
webSocket.setTLSOptions(tlsOptions);<br>
std::string url("wss://localhost:8080");<br>
webSocket.setUrl(url);</span><span style="font-size:10.0pt;font-family:"Helvetica Neue";color:#26282A;border:none windowtext 1.0pt;padding:0in"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.5pt;font-family:-apple-system;color:#232629;border:none windowtext 1.0pt;padding:0in"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#232629;border:none windowtext 1.0pt;padding:0in">No matter if the path of the key/certificate exists or not, I have the same error message from OpenSSL, which is weird...</span><span style="font-size:10.0pt;font-family:"Helvetica Neue";color:#232629;border:none windowtext 1.0pt;padding:0in"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.5pt;font-family:-apple-system;color:#232629;border:none windowtext 1.0pt;padding:0in"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><u><span style="font-size:11.5pt;font-family:-apple-system;color:#232629;border:none windowtext 1.0pt;padding:0in">So :</span></u></b><span style="font-size:11.5pt;font-family:-apple-system;color:#232629;border:none windowtext 1.0pt;padding:0in"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#232629;border:none windowtext 1.0pt;padding:0in">1. Any idea why I have <i>certificate verify failed</i>?</span><span style="font-size:10.0pt;font-family:"Helvetica Neue";color:#232629;border:none windowtext 1.0pt;padding:0in"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#232629;border:none windowtext 1.0pt;padding:0in">2. Is it normal that </span><em><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#24292F;border:none windowtext 1.0pt;padding:0in">s->verify_mode</span></em><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#24292F;border:none windowtext 1.0pt;padding:0in"> is
equal to <em><span style="font-family:"Arial",sans-serif">SSL_VERIFY_PEER</span></em> and <em><span style="font-family:"Arial",sans-serif">i</span></em> equal to <em><span style="font-family:"Arial",sans-serif">0</span></em></span><span style="font-size:10.0pt;font-family:"Helvetica Neue";color:#232629;border:none windowtext 1.0pt;padding:0in"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#24292F;border:none windowtext 1.0pt;padding:0in">3. Is it normal that <i>SSL_OP_NO_TLSv1_3</i> is enabled in the code?</span><span style="font-size:10.0pt;font-family:"Helvetica Neue";color:#26282A;border:none windowtext 1.0pt;padding:0in"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica Neue";color:#26282A;border:none windowtext 1.0pt;padding:0in"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#24292F;border:none windowtext 1.0pt;padding:0in">Thanks a lot for any help.</span><span style="font-size:10.0pt;font-family:"Helvetica Neue";color:#26282A;border:none windowtext 1.0pt;padding:0in"><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</body>
</html>