Bug to get client certificate

[noxxi]

Bug to get client certificate

[noxxi]

The example server only requests a certificate from the client if option --ca is set because only then the certificate can be verified. And if no certificate is requested the client will not send one. I've updated the code to make this more clear in the usage description.

[Logioniz]

Thanks, with --ca option works.

Can't understand how to get client certificate without verify and not specify client CA. It is possible?
So if i have my own self signed certificate which i want to check on server side. What i must to do?

[noxxi]

Can't understand how to get client certificate without verify and not specify client CA. It is possible?

As documented the certificate is requested if SSL_verify_mode is set to SSL_VERIFY_PEER. But the way the example programs works is that SSL_VERIFY_PEER is only used if option --ca is given. This is just an example program and not a full featured test server.

[Logioniz]

Oh, my question is not relevant for this example.

For example i have server with SSL_verify_mode option. How can i do client request with self signed certificate?

#!/usr/bin/perl
use Mojo::Base -strict;

use IO::Socket::SSL;
use DDP;

my $server = IO::Socket::SSL->new(
    # where to listen
    LocalAddr => '127.0.0.1',
    LocalPort => 3000,
    Listen => 10,

    # which certificate to offer
    # with SNI support there can be different certificates per hostname
    SSL_cert_file => 'tls/cert.pem',
    SSL_key_file => 'tls/key.pem',
    SSL_verify_mode => SSL_VERIFY_PEER
) or die "failed to listen: $!";

# accept client
my $client = $server->accept or die
    "failed to accept or ssl handshake: $!,$SSL_ERROR";

warn p $client->peer_certificates;

In this example i get certificate verify failed, because certificate is self signed.

[Logioniz]

Oh, very thanks. Found answer in your documentation. Need to set SSL_verify_callback option to validate.