<div dir="ltr">Hello M.Dukhovni,<div><br></div><div>Thank you for your reply. FYI, you missed an email I sent earlier yesterday, I mistakenly replied only to M. Wojcik instead of the openssl mailing list. I re-sent the email to the group. In the mail, I dug deeper in the code and added more information. </div><div><br></div><div>In your email, you told me </div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><i>But it does not confirm that the server sent a "full" certificate chain</i></blockquote><div><br></div><div>The screenshot below shows the chrome address bar of my React front end web page. The server is https, and I added the CA on the Trusted Root Certification Authorities store. It says that my connection is secured. Does it sound OK ?</div><div><br></div><div><img src="cid:ii_lbsowlgu0" alt="image.png" width="212" height="112"><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><i>It also does not confirm that you've set the correct peer hostname in the OpenSSL case</i></blockquote><div><br></div><div>I created a CA-Signed certificate for my dev sites and I used a SAN :</div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><font color="#0000ff" face="monospace">authorityKeyIdentifier=keyid,issuer</font></div><div><font color="#0000ff" face="monospace">basicConstraints=CA:FALSE</font></div><div><font color="#0000ff" face="monospace">keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment</font></div><div><font color="#0000ff" face="monospace">subjectAltName = @alt_names</font></div><div><font color="#0000ff" face="monospace"> </font></div><div><font color="#0000ff" face="monospace">[alt_names]</font></div><div><font color="#0000ff" face="monospace">DNS.1 = localhost</font></div><div><font color="#0000ff" face="monospace">IP.1 = 192.168.230.138</font></div><div><font color="#0000ff" face="monospace">IP.2 = 127.0.0.1</font></div></blockquote><div><br></div><div><br></div><div><br></div><div> By the way, all of this is for demo/prototype purposes. I am fully aware that when we will be ready to go on production, we will have to have a better understanding of SSL. Our first prototype iteration is to demonstrate the feasibility to have a web page communicate with our speech system on Windows platform using WebRTC. And WebRTC is available only with secure connection.</div><div><br></div><div>Thank you for reading all of this and thank you for your patience, it is really appreciated.</div><div><br></div><div>Pierre-Luc Boily</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Le sam. 17 déc. 2022, à 07 h 00, <<a href="mailto:openssl-users-request@openssl.org">openssl-users-request@openssl.org</a>> a écrit :<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Send openssl-users mailing list submissions to<br>
<a href="mailto:openssl-users@openssl.org" target="_blank">openssl-users@openssl.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://mta.openssl.org/mailman/listinfo/openssl-users" rel="noreferrer" target="_blank">https://mta.openssl.org/mailman/listinfo/openssl-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:openssl-users-request@openssl.org" target="_blank">openssl-users-request@openssl.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:openssl-users-owner@openssl.org" target="_blank">openssl-users-owner@openssl.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of openssl-users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: How to fix "OpenSSL failed - error:0A000086:SSL<br>
routines::certificate verify failed" (Viktor Dukhovni)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Fri, 16 Dec 2022 18:38:10 -0500<br>
From: Viktor Dukhovni <<a href="mailto:openssl-users@dukhovni.org" target="_blank">openssl-users@dukhovni.org</a>><br>
To: <a href="mailto:openssl-users@openssl.org" target="_blank">openssl-users@openssl.org</a><br>
Subject: Re: How to fix "OpenSSL failed - error:0A000086:SSL<br>
routines::certificate verify failed"<br>
Message-ID: <Y50BYt6lEZjc9/<a href="mailto:LR@straasha.imrryr.org" target="_blank">LR@straasha.imrryr.org</a>><br>
Content-Type: text/plain; charset=us-ascii<br>
<br>
On Fri, Dec 16, 2022 at 05:07:51PM -0500, Pierre-Luc Boily wrote:<br>
<br>
> 1. I have a React front end using wss to communicate to my https nodejs<br>
> server. *It works ->* *This confirms that my key and certificate are<br>
> valid.*<br>
<br>
But it does not confirm that the server sent a "full" certificate chain,<br>
with all the required intermediate certificates. It also does not<br>
confirm that you've set the correct peer hostname in the OpenSSL case<br>
(if you don't set the hostname at all, your connection is insecure).<br>
<br>
> So, I had to dig into the OpenSSL code and I found where the error is<br>
> triggered, see code below. In my case *s->verify_mode* is equal to<br>
> *SSL_VERIFY_PEER* and *i* equal to *0* and I don't know if those values are<br>
> OK or not.<br>
<br>
OpenSSL failed to validat the certificate chain, it could be missing<br>
intermediate certificates (from the server), or the wrong expected peer<br>
hostname specified on the client end. It could also be related to SNI,<br>
some servers return different certificates depending on what SNI name<br>
is signalled by the client.<br>
<br>
So double-check that the server certificate chain is complete (includes<br>
all intermediate CA certificates) optionally apart from a root CA (trust<br>
anchor) configured on the client.<br>
<br>
Then ensure that the client application correctly sets the SNI extension<br>
and the expected peer hostname to check in the server certificate.<br>
<br>
-- <br>
Viktor.<br>
<br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
_______________________________________________<br>
openssl-users mailing list<br>
<a href="mailto:openssl-users@openssl.org" target="_blank">openssl-users@openssl.org</a><br>
<a href="https://mta.openssl.org/mailman/listinfo/openssl-users" rel="noreferrer" target="_blank">https://mta.openssl.org/mailman/listinfo/openssl-users</a><br>
<br>
<br>
------------------------------<br>
<br>
End of openssl-users Digest, Vol 97, Issue 13<br>
*********************************************<br>
</blockquote></div>