Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was trying to connect to my server over ssl. The server and client are made possible using Openssl. I made the code for study purpose only. I made self signed certificates for clients and servers and i am using openssl s_client to test my server.

Everything works fine without client certificate. But when I gave the client certificate with the s_client it gives me the error.

# openssl s_client -connect localhost:443 -ssl3 -cert client.crt -key client.key
CONNECTED(00000003)
depth=0 /C=XX/ST=XXXX/L=XXXX/O=XXXX/OU=XXX/CN=SERV OWNER/emailAddress=SERVOWNER@ADDRESS.COM
verify error:num=18:self signed certificate
verify return:1
depth=0 /C=XX/ST=XXXXX/L=XXXX/O=XXXXXX/OUXXXXXXXX/CN=SERVOWNER/emailAddress=SERVOWNER@ADDRESS.COM
verify return:1
2804:error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate:s3_pkt.c:1102:SSL alert number 42
2804:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:539:

The server gives the following error at the same time

2803:error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned:s3_srvr.c:2619:
 I got a connection from (127.0.0.1 , 48096)

My client authentication code at server is:

if(verify_client == ON)
    {

        if (!SSL_CTX_load_verify_locations(ctx, RSA_SERVER_CA_CERT, NULL)) 
        {

            ERR_print_errors_fp(stderr);
            exit(1);

        }

        SSL_CTX_set_verify(ctx,SSL_VERIFY_PEER,NULL);
        SSL_CTX_set_verify_depth(ctx,1);

    }
share|improve this question
    
I imagine you created a self-signed CA and used it to create the client certificate. Have you added the self-signed CA certificate to your HTTPS enabled app server(apache I guess)? –  Andre de Miranda Oct 11 '12 at 9:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.