secure client/server program in C with OpenSSL

Question

Hello,

I'm trying to write a secure client/server program in C with OpenSSL. I've found a code sample at http://www.rtfm.com/openssl-examples/ but I get this error: server: SSL read problem client: Certificate doesn't verify

I think the problem is with the certificate generation, but I cannot find it.

Any idea?

Thanks

Answer 1

Get the value returned by SSL_get_verify_result(ssl) and compare it to the list of results in the Diagnostics section of OpenSSL's verify page. This will tell you the exact error.

Answer 2

I downloaded the example and verified the error:

"10 X509_V_ERR_CERT_HAS_EXPIRED: certificate has expired"

With this command:

openssl x509 -in client.pem -noout -text

I got this output:

Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number: 258 (0x102)
        Signature Algorithm: md5WithRSAEncryption
        Issuer: C=US, O=RTFM, Inc., OU=Widgets Division, CN=Test CA20010517
        Validity
            Not Before: May 17 16:11:36 2001 GMT
            Not After : Mar  6 16:11:36 2004 GMT
        Subject: C=US, O=RTFM, Inc., OU=Widgets Division, CN=client
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (1024 bit)
                Modulus (1024 bit):
                    00:87:35:64:a8:36:1e:a6:b1:4c:18:18:67:7b:4d:
                    84:03:b1:d4:86:d1:aa:3a:41:76:98:8e:4f:bb:f1:
                    9c:8c:41:e6:54:06:ed:9d:64:58:c6:e3:09:f3:90:
                    ac:2b:0f:8a:e9:fc:9e:4f:2d:1f:40:77:14:7b:da:
                    56:fd:01:ab:c4:38:a2:f6:50:31:c9:1a:cb:1c:66:
                    41:95:c3:f6:f3:65:bc:6b:28:5d:ab:bd:da:59:4a:
                    f2:8f:d4:e8:55:d4:c3:9d:b3:f5:93:a5:19:b5:81:
                    c9:95:4a:85:79:bc:b3:8c:a9:58:f3:8c:7a:31:43:
                    ff:b5:ce:98:f3:33:15:8b:d3
                Exponent: 65537 (0x10001)
    Signature Algorithm: md5WithRSAEncryption
        24:c9:85:14:79:b6:ff:00:ed:d7:39:fb:39:8a:47:54:3f:8b:
        ca:84:dc:ca:e7:9a:9f:cc:39:71:df:5f:e8:9f:27:fc:3e:b7:
        0a:1c:ff:27:78:12:7f:bb:a6:bf:a1:1a:c8:93:a1:f7:2d:d4:
        93:99:0d:6f:40:92:af:d9:1a:ed:7e:36:95:51:4f:b0:b0:e7:
        71:1d:33:0a:62:ec:0a:f0:64:0b:0b:21:40:6c:28:0e:d0:98:
        b4:db:77:08:d4:e5:2e:d6:95:9d:b8:7b:28:19:1f:2a:99:ac:
        ae:05:7b:0f:89:bb:39:45:92:4a:08:14:80:c2:7e:29:f2:cf:
        6e:26

Not After : Mar 6 16:11:36 2004 GMT

shows that was valid until 2004

You have to create a new certificate to use this example.

You can check those sites:

http://h71000.www7.hp.com/doc/83final/ba554_90007/ch04s02.html#cert2-fig

http://h71000.www7.hp.com/doc/83final/ba554_90007/ch04s03.html

http://blog.taragana.com/index.php/archive/openssl-how-to-create-self-signed-certificate/

http://sandbox.rulemaker.net/ngps/m2/howto.ca.html

http://sial.org/howto/openssl/ca