0
我嘗試建立與服務器的相互(2路)安全連接。我應該在沒有SSL3模式下使用客戶端證書(CRT文件類型)。如何建立與openssl的相互安全連接?
命令:
openssl s_client -connect example.com:443 -no_ssl3 -cert client.crt
輸出:
140386483435168:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:703:Expecting: ANY PRIVATE KEY
當我不使用所需的證書,它有不同的輸出。
命令:
openssl s_client -connect example.com:443 -no_ssl3
輸出:
CONNECTED(00000003)
depth=2 DC = com, DC = example, O = blah, OU = blah, CN = blah
verify error:num=19:self signed certificate in certificate chain
verify return:0
140181058492064:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1262:SSL alert number 40
140181058492064:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177:
---
Certificate chain
0 s:/C=US/ST=blaaaah/L=blaaaah/O=blaaaah/OU=blaaaah/CN=example.com
i:/DC=com/DC=example/O=blah/OU=blah/CN=blah
1 s:/DC=com/DC=example/O=blah/OU=blah/CN=blah
i:/DC=com/DC=example/O=blah/OU=blah/CN=blah
2 s:/DC=com/DC=example/O=blah/OU=blah/CN=blah
i:/DC=com/DC=example/O=blah/OU=blah/CN=blah
---
Server certificate
-----BEGIN CERTIFICATE-----
blaaaah
-----END CERTIFICATE-----
subject=/C=US/ST=blaaaah/L=blaaaah/O=blaaaah/OU=blaaaah/CN=example.com
issuer=/DC=com/DC=blaaaah/O=blaaaah/OU=blah/CN=blaaaah
---
Acceptable client certificate CA names
/DC=com/DC=example/O=blaaaah/OU=blaaaah/CN=blaaaah
.
.
.
.etc.
---
SSL handshake has read 5458 bytes and written 330 bytes
---
New, TLSv1/SSLv3, Cipher is DES-CBC3-SHA
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1
Cipher : DES-CBC3-SHA
Session-ID: B1259877305945E0AAAAAA2FE38DA46B5A5813F6513D0DC5BF92FB6AD32287569
Session-ID-ctx:
Master-Key: blaaaah
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1450452192
Timeout : 300 (sec)
Verify return code: 19 (self signed certificate in certificate chain)
---
什麼是錯的?