Hi Hans-Jürgen,

Thanks for the report.  I'll look into this and get back to you.

Best Regards,
Chris

Hi Chris

I Understand. Thank you very much for your explanation. I was guessing similar.
After defined FP_MAX_BITS >= 8192 it works.

Maybe you could mention it in the API doc's somewhere, ie at wolfSSL_CTX_set_verify() and/or in the INSTALL?

Another question... just for understanding:
If i understand it right, wolfSSLv23_client_method() is meant connecting to a SSL/TLS server with the highest possible SSL/TLS protocol, beginning from TLSv1.2 down to TLSv1.1 -> TLSv1 -> SSLv3

I noticed that if a SSL/TLS Server supports (only) SSLv3 and TLSv1 but not TLSv1.1/TLSv1.2 the connect will failed if using wolfSSLv23_client_method(), but will work only when using wolfTLSv1_client_method() or wolfSSLv3_client_method()

For example cacert.org (Supports SSLv3 and/or TLSv1, but not TLSv1.1/TLSv1.2):

using wolfSSLv23_client_method()

./examples/client/client -h www.cacert.org -p 443 -d
err = -226, record layer version error
yassl error: SSL_connect failed

using wolfSSLv3_client_method():

./examples/client/client -h www.cacert.org -p 443 -d -v 0
SSL version is SSLv3

using wolfTLSv1_client_method():

./examples/client/client -h www.cacert.org -p 443 -d -v 1
SSL version is TLSv1

While on a SSLv3, TLSv1, TLSv1.1, TLSv1.2 capable server, like google.com, wolfSSLv23_client_method() works fine, ie:

./examples/client/client -h google.com -p 443 -d
SSL version is TLSv1.2

So my question is, is there maybe a bug in wolfSSLv23_client_method() or is wolfSSLv23_client_method() meant only for SSLv3/TLSv1 servers, using the highest possible SSL/TLS version?

Thank you for your time.
Greetings
Hans-Jürgen

Hi Hans-Jürgen,

I just tested against www.cacert.org:443 using our example client and the wolfSSLv23_client_method(), and the connection worked ok for me.

To do the test, I just made a quick change of wolfSSLv3_client_method() to wolfSSLv23_client_method() in client.c (just a quick and dirty change to let me select it using "-v 0" from the command line), then did:

make clean
make
./examples/client/client -h www.cacert.org -p 443 -d -v 0 -g

Best Regards,
Chris

Hi Hans-Jürgen,

Ok, thanks for the clarification.  I'm glad we were able to get things figured out!

Best Regards,
Chris

Hi Hans-Jürgen,

The reason that OpenSSL worked in this case is because when s_client received the client certificate request, it was sending a blank client certificate automatically (without you having to load one).  With wolfSSL 2.7.0 on the other hand, if the application didn't load a client certificate, and the server requested one, wolfSSL wouldn't send a blank client certificate with TLS 1.0 or TLS 1.1 because it wasn't required by the RFC.  Only with TLS 1.2 (as required).

We just fixed this issue as of this commit (https://github.com/cyassl/cyassl/commit … 6e99d21ac6).  If you update to our latest GitHub code, your connection should now work as expected.  wolfSSL will now send a blank client certificate for TLS 1.0, 1.1, and 1.2 if the server requests one and the application has not loaded a client certificate.

Best Regards,
Chris

I have the same problem , and the problem exists after compiling it with "-DFP_MAX_BITS=8192".

wolfSSL was got from github, the version is " Sep 20, 2013,  master branch  commit bdb8b9396c "

I compiled the source code on Windows 7 with VS2010.

Reuslt:

Hello I'm working on a wolfSSL project at the moment and I was wondering how to port some certifications on my application.  The only example that works is that mention before on this thread for "vpn-students.poly.edu".

If I use a root certificate at .pem format from cacert.org the ssl authentication fails:

The certificate I use is attached.

The code functions I use are the following:

wolfSSL_Debugging_ON();
wolfSSL_Init();

ssl->method=wolfTLSv1_client_method();
        
ssl->ctx = wolfSSL_CTX_new(ssl->method);

wolfSSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_PEER, 0);

wolfSSL_CTX_load_verify_locations(ssl->ctx,"./cacert.pem",0);
/*or  converted with hexdump*/
wolfSSL_CTX_load_verify_buffer(sock_ssl->ctx,eco_cert,sizeof(eco_cert), SSL_FILETYPE_PEM);
    
ssl->ssl = wolfSSL_new(ssl->ctx);

wolfSSL_set_fd(ssl->ssl, ssl->ID);
        ret=wolfSSL_connect(ssl->ssl);
        if (ret!= SSL_SUCCESS){err = wolfSSL_get_error(sock_ssl->ssl, ret);}

The Error Code i get is -155.... can anyone provide any advise...

Dear Chrisc,

My problems on finding the proper certificates still exists, after may trials I found some combinations that worked. Although I would be very cheerfull for a better understanding.

The combinations which worked for me are the following:

. google. com      Equifax_Secure_CA.pem
. paypal. com     Verisign_Class_3_Public_Primary_Certification_Authority.pem
. amazon. co.uk Verisign_Class_3_Public_Primary_Certification_Authority.pem

But the following combination make me wondering:

https:// www. microsoft. com GTE_CyberTrust_Global_Root.pem

because it did not verified.

I grabed these certificates from my Linux machine under /etc/ssl/certs path.

Could you please provide me some info about the certificated wolfssl needs in order to verify the server. I read on the wolfssl manuals that it uses the ROOT CA certifictes, these certificates are self signed rigth? If I use a self extracted and self signed certificate would it work?

Could you please provide some info or examples with public servers would be very appreciated!

Where can I find more info about the extraction of certificates and how do you extract/use them?

I use the wolfSSL_CTX_load_verify_locations() and the wolfSSL_CTX_load_verify_buffer() depending the platform I use (PC / embedded device).

Best Regards,
Cyberrobot

Many thanks for your time!