libwebsockets icon indicating copy to clipboard operation
libwebsockets copied to clipboard

tls client key error

Open calvin2021y opened this issue 4 years ago • 1 comments

I test the tls client key and cert with vhost, get this error:

 E: SSL error: unable to get local issuer certificate

curl conform the key is work with curl --cert client_cert.pem --key client_key.pem https://domain.com

I use this to convert pem into der format:

 openssl x509 -inform pem -in client_cert.pem -outform der -out client_cert.der
 openssl ec -inform pem -in client_key.pem -outform der -out client_key.der

the code with lws:

		info.client_ssl_ca_mem = client_cert_ptr;
		info.client_ssl_ca_mem_len =client_cert_len;
		info.client_ssl_key_mem	= client_key_ptr;
		info.client_ssl_key_mem_len = client_key_len;

I also try this:

lws_tls_client_vhost_extra_cert_mem2(app_vhost, client_cert_ptr, client_cert_len);

calvin2021y avatar Jul 28 '21 08:07 calvin2021y

my work around is add global patch into lws_ssl_client_bio_create:

			if( SSL_use_certificate_ASN1(wsi->tls.ssl, global_cert_ptr, global_cert_len) != 1) {
				lwsl_err("%s: use_privkey failed\n", __func__);
				goto no_client_cert;
			}
			if( SSL_use_PrivateKey_ASN1(EVP_PKEY_EC, wsi->tls.ssl, global_key_ptr, global_key_len) != 1) {
				lwsl_err("%s: use_privkey failed\n", __func__);
				goto no_client_cert;
			}
			if (SSL_check_private_key(wsi->tls.ssl) != 1) {
				lwsl_err("Private SSL key doesn't match cert\n");
				lws_tls_err_describe_clear();
				return 1;
			}

and set vhost ssl to null:

		info.client_ssl_ca_mem = NULL;
		info.client_ssl_ca_mem_len =0;
		info.client_ssl_key_mem	= NULL;
		info.client_ssl_key_mem_len = 0;

I don't know why get this problem, a better patch will be great.

calvin2021y avatar Jul 29 '21 10:07 calvin2021y