Let's say I have PC A and PC B. Assuming both have certificates signed by a CA. How can I do mutual authentication here using openssl. What are the commands I have to use ? Brief explanation with some commands will help a lot.


Well, to simply connect to PC using openssl you have to use openssl s_server on one side and openssl s_client on another side:

PCA> openssl s_server -cert ./server.crt -key ./server.key -accept 8443
PCB> openssl s_client -connect PCA:8443

And if you really want mutual authentication here using openssl, you should add verification checks for openssl:

PCA> openssl s_server -cert ./server.crt -key ./server.key -accept 8443 -Verify on -verify_return_error
PCB> openssl s_client -connect PCA:8443 -cert ./client.crt -key ./client.key -verify on -verify_return_error 

so both sides will drop connection in case of there are problems with certificates.

| improve this answer | |
  • thanks, I exactly need this. I will try it out and mark this as accepted. Just one question, Don't I have to -CAfile ca_cert.crt also to validate the certificate is signed by correct CA ? – tarun14110 Nov 19 '16 at 14:08
  • Simply: yes, you have to use -CAfile ca_cert.crt.But also you should use -crl_check to check certificates for revocation. In more details: there are number of options: you may use -CApath or SSL_CERT_DIR and SSL_CERT_FILE environment variables. Or place your CA to cert.pem file under openssl version -a | grep DIR directory. Just choose any way you'd like. – Fedor Dikarev Nov 19 '16 at 15:15

To connect to either A or B using openssl you could use something like:

openssl s_client -connect x.x.x.x:443

or more verbose (printing the certs)

openssl s_client -showcerts -connect x.x.x.x:443

Where x.x.x.x is the IP or host.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.