• Registered: 2017-03-19
  • Posts: 15

Topic: [SOLVED] ASN no signer to confirm failure when a clients connecting

I implement a process based on wolfssl in QNX platform.
Set the CipherSuit(ECDHE-ECDSA-AES128-GCM-SHA256), load server.cert, server.key, ca.cert.
Then a client connecting with some corresponding authentications, Verification OK.

However, server-side load certchain.cert instead of ca.cert, the Verification is not OK.
And the -188 error is printed in the server-side function VerifyCallback().

I made the certification chain by writing server.cert and ca.cert to a new file certchain.cert.
Is this method of make certification chain correct?

And What can be the cause of the error -188 and how can I solve this?
Thank You.

server.cer:
-----BEGIN CERTIFICATE-----
MIIBzjCCAXSgAwIBAgIIAT8Lw/rhH90wCgYIKoZIzj0EAwIwbTELMAkGA1UEBhMC
ZGUxDzANBgNVBAgMBmJlcmxpbjEPMA0GA1UEBwwGYmVybGluMQwwCgYDVQQKDANp
YXYxDjAMBgNVBAsMBXZjZDIxMR4wHAYDVQQDDBVWSU49V1ZXWlpaM0NaRlA0MDAx
NjgwIhgPMjAxNTAxMzEwNzA4MTFaGA8yMDE2MDYxNTA3MDgxMVowaTELMAkGA1UE
BhMCZGUxDzANBgNVBAgMBmJlcmxpbjEPMA0GA1UEBwwGYmVybGluMQwwCgYDVQQK
DANpYXYxDjAMBgNVBAsMBXZjZDIxMRowGAYDVQQDDBFVU0FHRT1WaVdpIFNlcnZl
cjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABGbsi52pPLltJC0kg2NRIThRcWtU
R93q84fsscTB2cxecauTHU4mMA62IqAFoc2ueI32zGVqxZNrX5dGr6LCwQcwCgYI
KoZIzj0EAwIDSAAwRQIhANYv2Gc4UUIKD6hsT/EaKecFxfz1LgYv4uFRlyAoLev1
AiBJDvBX0+pPjgTSX+zajNiIBnssitpNtWMG3+osJuMH4A==
-----END CERTIFICATE-----


ca.cer:
-----BEGIN CERTIFICATE-----
MIIB4zCCAYqgAwIBAgIIAb9ffAF3qDYwCgYIKoZIzj0EAwIwbTELMAkGA1UEBhMC
ZGUxDzANBgNVBAgMBmJlcmxpbjEPMA0GA1UEBwwGYmVybGluMQwwCgYDVQQKDANp
YXYxDjAMBgNVBAsMBXZjZDIxMR4wHAYDVQQDDBVWSU49V1ZXWlpaM0NaRlA0MDAx
NjgwIhgPMjAxNTAxMzEwNzA4MTFaGA8yMDE2MDYxNTA3MDgxMVowbTELMAkGA1UE
BhMCZGUxDzANBgNVBAgMBmJlcmxpbjEPMA0GA1UEBwwGYmVybGluMQwwCgYDVQQK
DANpYXYxDjAMBgNVBAsMBXZjZDIxMR4wHAYDVQQDDBVWSU49V1ZXWlpaM0NaRlA0
MDAxNjgwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAS9wg9h9M63AW8Se/WBIiwJ
zTg3VvZeeJ2+6QWLE+tGkpa2svkMWKg4u85dJvB/k3vv/uiH+n+VwqvIFerYpSQB
oxAwDjAMBgNVHRMEBTADAQH/MAoGCCqGSM49BAMCA0cAMEQCICFtUyZt9wissRUY
heK7maQXI8x0wpD1ymrW1/BXcLPAAiB/lggjxYETD7m+NROj2jQsSyWHkFdIq2MI
X/CpG/SY5g==
-----END CERTIFICATE-----

certchain.cer:
-----BEGIN CERTIFICATE-----
MIIBzjCCAXSgAwIBAgIIAT8Lw/rhH90wCgYIKoZIzj0EAwIwbTELMAkGA1UEBhMC
ZGUxDzANBgNVBAgMBmJlcmxpbjEPMA0GA1UEBwwGYmVybGluMQwwCgYDVQQKDANp
YXYxDjAMBgNVBAsMBXZjZDIxMR4wHAYDVQQDDBVWSU49V1ZXWlpaM0NaRlA0MDAx
NjgwIhgPMjAxNTAxMzEwNzA4MTFaGA8yMDE2MDYxNTA3MDgxMVowaTELMAkGA1UE
BhMCZGUxDzANBgNVBAgMBmJlcmxpbjEPMA0GA1UEBwwGYmVybGluMQwwCgYDVQQK
DANpYXYxDjAMBgNVBAsMBXZjZDIxMRowGAYDVQQDDBFVU0FHRT1WaVdpIFNlcnZl
cjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABGbsi52pPLltJC0kg2NRIThRcWtU
R93q84fsscTB2cxecauTHU4mMA62IqAFoc2ueI32zGVqxZNrX5dGr6LCwQcwCgYI
KoZIzj0EAwIDSAAwRQIhANYv2Gc4UUIKD6hsT/EaKecFxfz1LgYv4uFRlyAoLev1
AiBJDvBX0+pPjgTSX+zajNiIBnssitpNtWMG3+osJuMH4A==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIB4zCCAYqgAwIBAgIIAb9ffAF3qDYwCgYIKoZIzj0EAwIwbTELMAkGA1UEBhMC
ZGUxDzANBgNVBAgMBmJlcmxpbjEPMA0GA1UEBwwGYmVybGluMQwwCgYDVQQKDANp
YXYxDjAMBgNVBAsMBXZjZDIxMR4wHAYDVQQDDBVWSU49V1ZXWlpaM0NaRlA0MDAx
NjgwIhgPMjAxNTAxMzEwNzA4MTFaGA8yMDE2MDYxNTA3MDgxMVowbTELMAkGA1UE
BhMCZGUxDzANBgNVBAgMBmJlcmxpbjEPMA0GA1UEBwwGYmVybGluMQwwCgYDVQQK
DANpYXYxDjAMBgNVBAsMBXZjZDIxMR4wHAYDVQQDDBVWSU49V1ZXWlpaM0NaRlA0
MDAxNjgwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAS9wg9h9M63AW8Se/WBIiwJ
zTg3VvZeeJ2+6QWLE+tGkpa2svkMWKg4u85dJvB/k3vv/uiH+n+VwqvIFerYpSQB
oxAwDjAMBgNVHRMEBTADAQH/MAoGCCqGSM49BAMCA0cAMEQCICFtUyZt9wissRUY
heK7maQXI8x0wpD1ymrW1/BXcLPAAiB/lggjxYETD7m+NROj2jQsSyWHkFdIq2MI
X/CpG/SY5g==
-----END CERTIFICATE-----

Share

  • From: Bozeman
  • Registered: 2014-05-09
  • Posts: 777

Re: [SOLVED] ASN no signer to confirm failure when a clients connecting

Hi muyouyuwan,

However, server-side load certchain.cert instead of ca.cert, the Verification is not OK.

It appears you are doing client authentication on the server, is that your intent? I ask because 99% of all servers in the world do not do client authentication as that would require having the Certificate Authority for every client you ever expect to connect to that server. This creates a lot of overhead unless you have a very specific use-case and you DO want to guarantee that only clients with certificates signed by a specific CA can connect to your server. I just want to make sure you actually intend to be doing this.

And the -188 error is printed in the server-side function VerifyCallback().
I made the certification chain by writing server.cert and ca.cert to a new file certchain.cert.
Is this method of make certification chain correct?
And What can be the cause of the error -188 and how can I solve this?
Thank You.

To do client authentication (if that is your desire) the chain loaded into the "VerifyLocations" should be "client-cert" and the "ca cert" (more specifically, the ca that signed the client certificate). In our test certs the <wolf-root>/certs/ca-cert was used to sign both the client and the server certs, that's why you can load just the ca and be ok but then if you place the server cert in the chain, the server cert never was part of the clients chain so the verification will fail.

Regards,

Kaleb

Kaleb J. Himes's Website

Share

3 Reply by muyouyuwan (edited by muyouyuwan 2017-04-04 22:14:57)

  • Registered: 2017-03-19
  • Posts: 15

Re: [SOLVED] ASN no signer to confirm failure when a clients connecting

Hi Kaleb,
Thanks for your reply.And i want to confirm somethings i'm not sure yet.

To do client authentication (if that is your desire) the chain loaded into the "VerifyLocations" should be "client-cert" and the "ca cert"

According to your reply, if i want to do client authentication,  the server-side or client-side should load the chain which made with "client-cert" and "ca-cert"?

Share

  • From: Bozeman
  • Registered: 2014-05-09
  • Posts: 777

Re: [SOLVED] ASN no signer to confirm failure when a clients connecting

Hi muyouyuwan,

By default a client should always do peer authentication to verify the server the client is connecting to is the server the client "Thinks" it is and not some man-in-the-middle pretending to be the server. So the client will use these API's

CLIENT:

wolfSSL_CTX_load_verify_(locations/buffer) -> Where the file/buffer being loaded contains the SERVERS Root CA.
wolfSSL_CTX_use_private_key_(file/buffer) -> Where the private key being loaded is the CLIENTS Private key
wolfSSL_CTX_use_certificate_(file/buffer) -> Where the certificate being loaded is the CLIENTS certificate

Next, 99% of all servers in the world DO NOT do client authentication since just about anyone is allowed to connect to a server. Google for example does not have a copy of every certificate burned into every laptop in the world to do client authentication with, that is a LOT of certificates. HOWEVER if you do want to do client authentication then the server would use the same API's but in the "wolfSSL_CTX_load_verify_(locations/buffer) the server would load the Root CA that signed the clients certificate:

SERVER:

wolfSSL_CTX_load_verify_(locations/buffer) -> Where the file/buffer being loaded contains the CLIENTS Root CA.
wolfSSL_CTX_use_private_key_(file/buffer) -> Where the private key being loaded is the SERVERS Private key
wolfSSL_CTX_use_certificate_(file/buffer) -> Where the certificate being loaded is the SERVERS certificate


Regards,

Kaleb

Kaleb J. Himes's Website

Share

  • From: Bozeman
  • Registered: 2014-05-09
  • Posts: 777

Re: [SOLVED] ASN no signer to confirm failure when a clients connecting

Hi muyouyuwan,

I just wanted to check back today on how your project is going. If possible can you share any details of what it is you're working on and what are the end goals for the project?

Of course if you have any other questions please let us know, wolfSSL is always happy to help in any way we can.


Best Regards,

Kaleb

Kaleb J. Himes's Website

Share

  • Registered: 2017-03-19
  • Posts: 15

Re: [SOLVED] ASN no signer to confirm failure when a clients connecting

hi Kaleb，
     I'm sorry to reply late. And thanks for your kindly answer.
     My project is working on a special situation and it require the server to verify every clients. I made mistakes when loading verify certification. However, it works well accroding to your answer.

Thanks very much.

Share

  • From: Bozeman, MT
  • Registered: 2010-10-20
  • Posts: 647

Re: [SOLVED] ASN no signer to confirm failure when a clients connecting

Hi muyouyuwan,

Thanks for letting us know that Kaleb's suggestions helped.  Glad you got things working!

Best Regards,
Chris

https://www.wolfssl.com

chrisc's Website

Share