libwebsockets
libwebsockets copied to clipboard
tls client key error
I test the tls client key and cert with vhost, get this error:
E: SSL error: unable to get local issuer certificate
curl conform the key is work with curl --cert client_cert.pem --key client_key.pem https://domain.com
I use this to convert pem into der format:
openssl x509 -inform pem -in client_cert.pem -outform der -out client_cert.der
openssl ec -inform pem -in client_key.pem -outform der -out client_key.der
the code with lws:
info.client_ssl_ca_mem = client_cert_ptr;
info.client_ssl_ca_mem_len =client_cert_len;
info.client_ssl_key_mem = client_key_ptr;
info.client_ssl_key_mem_len = client_key_len;
I also try this:
lws_tls_client_vhost_extra_cert_mem2(app_vhost, client_cert_ptr, client_cert_len);
my work around is add global patch into lws_ssl_client_bio_create:
if( SSL_use_certificate_ASN1(wsi->tls.ssl, global_cert_ptr, global_cert_len) != 1) {
lwsl_err("%s: use_privkey failed\n", __func__);
goto no_client_cert;
}
if( SSL_use_PrivateKey_ASN1(EVP_PKEY_EC, wsi->tls.ssl, global_key_ptr, global_key_len) != 1) {
lwsl_err("%s: use_privkey failed\n", __func__);
goto no_client_cert;
}
if (SSL_check_private_key(wsi->tls.ssl) != 1) {
lwsl_err("Private SSL key doesn't match cert\n");
lws_tls_err_describe_clear();
return 1;
}
and set vhost ssl to null:
info.client_ssl_ca_mem = NULL;
info.client_ssl_ca_mem_len =0;
info.client_ssl_key_mem = NULL;
info.client_ssl_key_mem_len = 0;
I don't know why get this problem, a better patch will be great.