2015-12-18 75 views
0

我嘗試建立與服務器的相互(2路)安全連接。我應該在沒有SSL3模式下使用客戶端證書(CRT文件類型)。如何建立與openssl的相互安全連接?

命令:

openssl s_client -connect example.com:443 -no_ssl3 -cert client.crt 

輸出:

140386483435168:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:703:Expecting: ANY PRIVATE KEY 

當我不使用所需的證書,它有不同的輸出。

命令:

openssl s_client -connect example.com:443 -no_ssl3 

輸出:

CONNECTED(00000003) 
depth=2 DC = com, DC = example, O = blah, OU = blah, CN = blah 
verify error:num=19:self signed certificate in certificate chain 
verify return:0 
140181058492064:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1262:SSL alert number 40 
140181058492064:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177: 
--- 
Certificate chain 
0 s:/C=US/ST=blaaaah/L=blaaaah/O=blaaaah/OU=blaaaah/CN=example.com 
    i:/DC=com/DC=example/O=blah/OU=blah/CN=blah 
1 s:/DC=com/DC=example/O=blah/OU=blah/CN=blah 
    i:/DC=com/DC=example/O=blah/OU=blah/CN=blah 
2 s:/DC=com/DC=example/O=blah/OU=blah/CN=blah 
    i:/DC=com/DC=example/O=blah/OU=blah/CN=blah 
--- 
Server certificate 
-----BEGIN CERTIFICATE----- 
blaaaah 
-----END CERTIFICATE----- 
subject=/C=US/ST=blaaaah/L=blaaaah/O=blaaaah/OU=blaaaah/CN=example.com 
issuer=/DC=com/DC=blaaaah/O=blaaaah/OU=blah/CN=blaaaah 
--- 
Acceptable client certificate CA names 
/DC=com/DC=example/O=blaaaah/OU=blaaaah/CN=blaaaah 

. 
. 
. 
.etc. 

--- 
SSL handshake has read 5458 bytes and written 330 bytes 
--- 
New, TLSv1/SSLv3, Cipher is DES-CBC3-SHA 
Server public key is 2048 bit 
Secure Renegotiation IS NOT supported 
Compression: NONE 
Expansion: NONE 
SSL-Session: 
    Protocol : TLSv1 
    Cipher : DES-CBC3-SHA 
    Session-ID: B1259877305945E0AAAAAA2FE38DA46B5A5813F6513D0DC5BF92FB6AD32287569 
    Session-ID-ctx: 
    Master-Key: blaaaah 
    Key-Arg : None 
    PSK identity: None 
    PSK identity hint: None 
    SRP username: None 
    Start Time: 1450452192 
    Timeout : 300 (sec) 
    Verify return code: 19 (self signed certificate in certificate chain) 
--- 

什麼是錯的?

回答

1

由於錯誤消息指出,您需要私鑰用於證書(可能還需要一個密碼,如果加密的話 - 您將得到提示)。因此,您需要添加-key myPrivateKey.key,假設它是PEM編碼的。