Using a self-signed certificate

Question

I am just trying to get my head around SSL.

I have set up a Jetty server on my localhost, and generated my own certificate using Keytool.

Now when I go to https://localhost:8443/ I get the can't trust this certificate error.

I use

keytool -export -alias pongus -keystore keystore -file certfile.cer

To create the certificate which I think is what the client needs to authenticate with the server. (This is where I could be very wrong!)

I have the following ruby code :

require 'net/https'
require 'openssl'

require 'open-uri'

puts 'yay' if File.exists?('certfile.cer')

uri = URI.parse("https://localhost:8443/")
http_session = Net::HTTP.new(uri.host, uri.port)
http_session.use_ssl = true
http_session.verify_mode = OpenSSL::SSL::VERIFY_PEER
http_session.ca_file = 'certfile.cer'
res = http_session.start do |http|
  # do some requests here
  http.get('/')
end

This does print 'yay', so the certfile.cer file does exist.

But I get the errors

/Applications/NetBeans/NetBeans 6.8.app/Contents/Resources/NetBeans/ruby2/jruby-1.4.0/lib/ruby/1.8/net/http.rb:586 warning: can't set verify locations
/Applications/NetBeans/NetBeans 6.8.app/Contents/Resources/NetBeans/ruby2/jruby-1.4.0/lib/ruby/1.8/net/http.rb:586:in `connect': certificate verify failed (OpenSSL::SSL::SSLError)

Any ideas what I am doing wrong?

EDIT

I want to get it so I guarantee that I am connecting to the right server, and the server can guarantee that it is me connecting to it, without any tampering in between. I am developing both the server and the client.

Answer 1

Change

http_session.verify_mode = OpenSSL::SSL::VERIFY_PEER

to

http_session.verify_mode = OpenSSL::SSL::VERIFY_NONE

Once you do that, the SSL will work properly. I have used this multiple times in my development environments, always works flawlessly.

Answer 2

Your client needs access to its private key. The private key is not in the certificate, the certificate only contains the public key. Sorry, I don't know ruby, but a common technique is to bundle the private key and certificate in a single PKCS#12, aka p12, file and supply this to the crypto library.