Hi Todd

In my test:

Fails (on my local Windows7 machine) with:

While

Works.

In the (StartSSL) cert, the CN=www.jabber.se and altname=jabber.se... so it should work... should'nt it?

Or did i miss something?

Thank you for your time.
Greetings Hans-Jürgen Petrich

PS: client.exe was compiled on windows7(64bit) with mwing32 with the following ./configure

Hallo Todd, thank you for your reply.
Ohh,  i have to check it again (btw: i'm using the Version 3.2.0).
Maybe it's because i have to deal with wildcard* (alt)names in the cert. Does CyaSSL_check_domain_name() support wildcard (alt)names?

Thank you very much für your help.
Best greetings
Hans-Jürgen Petrich

Hi Cuzz,
it seems that your case is an other issue.
Did you try loading the proper certificate authority file with -A ?

I did. And it works.
The cert issuer on this SSL/TLS Server is GeoTrust. So i downloaded: http://www.geotrust.com/resources/root_ … bal_CA.pem first.

wget -O ../../certs/GeoTrust_Global_CA.pem http://www.geotrust.com/resources/root_certificates/certificates/GeoTrust_Global_CA.pem
client.exe -h vpn-students.poly.edu -p 443 -v 1 -A certs/GeoTrust_Global_CA.pem

Result:

peer's cert info:
 issuer : /C=US/O=GeoTrust, Inc./CN=GeoTrust SSL CA
 subject: /C=US/ST=New York/L=Brooklyn/O=Polytechnic Institute of New York University/OU=Information Systems/CN=vpn-students.poly.edu
 altname = vpn-students.poly.edu
 serial number:01:82:4c
SSL version is TLSv1
SSL cipher suite is TLS_RSA_WITH_AES_256_CBC_SHA

Should work with your client.exe also.
Greetings Hans-Jürgen

Hi Yun,

i think you are looking for:

wolfSSL_check_domain_name()
https://github.com/cyassl/cyassl/blob/m … ent.c#L628

and maybe additional also for:
wolfSSL_CTX_load_verify_locations()
https://github.com/cyassl/cyassl/blob/m … ent.c#L535

Greetings Hans-Jürgen

Hi Chris,
can confirm that. Was, as said, my fault.

Background was:
I had some trouble with an SSL/TLS Server (hobana.freenode.net) [using TLSv1 or SSLv3 protocol] where it is required using a client cert if connecting with TLSv1, but if connecting with SSLv3 the Server does not requiring a cert from the client.

Strange anyhow, or?

I was connecting to the server using wolfSSLv23_client_method()... but did'nt load a cert.

Because wolfSSLv23_client_method() is, of course, using TLSv1 first, the SSL_connect() failed with -1.
But was working with wolfSSLv3_client_method().

I wrongly was thinking then something with wolfSSLv23_client_method() is wrong... but did'nt realize that this Server, only in TLSv1, is requiring a client cert, which i not gave. That why the SSL_connect() failed with an alert.

Was testing it then with cacert.org... and the connect failed also. But the connect failed because default was TLSv1.2 ... which cacert does not support....

But now it's all clear

... thank you again for helping, and for wolfSSL embedded SSL!

Greetings
Hans-Jürgen 

Hi Chris

I Understand. Thank you very much for your explanation. I was guessing similar.
After defined FP_MAX_BITS >= 8192 it works.

Maybe you could mention it in the API doc's somewhere, ie at wolfSSL_CTX_set_verify() and/or in the INSTALL?

Another question... just for understanding:
If i understand it right, wolfSSLv23_client_method() is meant connecting to a SSL/TLS server with the highest possible SSL/TLS protocol, beginning from TLSv1.2 down to TLSv1.1 -> TLSv1 -> SSLv3

I noticed that if a SSL/TLS Server supports (only) SSLv3 and TLSv1 but not TLSv1.1/TLSv1.2 the connect will failed if using wolfSSLv23_client_method(), but will work only when using wolfTLSv1_client_method() or wolfSSLv3_client_method()

For example cacert.org (Supports SSLv3 and/or TLSv1, but not TLSv1.1/TLSv1.2):

using wolfSSLv23_client_method()

./examples/client/client -h www.cacert.org -p 443 -d
err = -226, record layer version error
yassl error: SSL_connect failed

using wolfSSLv3_client_method():

./examples/client/client -h www.cacert.org -p 443 -d -v 0
SSL version is SSLv3

using wolfTLSv1_client_method():

./examples/client/client -h www.cacert.org -p 443 -d -v 1
SSL version is TLSv1

While on a SSLv3, TLSv1, TLSv1.1, TLSv1.2 capable server, like google.com, wolfSSLv23_client_method() works fine, ie:

./examples/client/client -h google.com -p 443 -d
SSL version is TLSv1.2

So my question is, is there maybe a bug in wolfSSLv23_client_method() or is wolfSSLv23_client_method() meant only for SSLv3/TLSv1 servers, using the highest possible SSL/TLS version?

Thank you for your time.
Greetings
Hans-Jürgen