3

I have an HTTPS Service which uses SSL/TLS client authentication and requires a certificate to be presented. How can I get a list of Acceptable client certificate CA names using openssl s_client without presenting a client certificate?

If I try without a client certificate I get the following error:

4967:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:
Improve this question

2 Answers 2

Reset to default
3

You need to use the -prexit option:

E.g.

openssl s_client -connect server:8443 -prexit

print session information when the program exits. This will always attempt to print out information even if the connection fails. Normally information will only be printed out once if the connection succeeds. This option is useful because the cipher in use may be renegotiated or the connection may fail because a client certificate is required or is requested only after an attempt is made to access a certain URL. Note: the output produced by this option is not always accurate because a connection might never have been established.

Improve this answer
0

Use the following command:

openssl s_client -connect website_fqdn:443 -state -nbio 2>&1

The output will contain 'Acceptable client certificate CA names'

Improve this answer
3
  • That doesn't work where a SSL server "requires" a client cert. If the client certs were "optional" then it may show acceptable certs, but so would the command in my question. -state, -nbio and certainly 2>&1 do nothing to make acceptable CAs show in the response.
    – Alastair McCormack
    Sep 22, 2017 at 14:46
  • @AlastairMcCormack: Your question is not clear that your SSL server is requiring a client cert. If that's a key piece of your question, and it appears so by your comment, I believe your question should be edited.
    – Scott Lundberg
    Sep 22, 2017 at 15:28
  • @ScottLundberg It's implied by the situation and error message given. "Optional" mode wouldn't be client authentication - it would be optional client authentication. Further, in "optional" mode, I would not have got an error using the openssl s_client cmd given in my question. I agree that it would be useful to be explicit and add "requires" to the question, but the fact remains that this answer neither adds or explains.
    – Alastair McCormack
    Sep 22, 2017 at 15:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .