• Registered: 2016-08-14
  • Posts: 47

Topic: ASN_NO_SIGNER_E means what??? (during TLS handshake)

Hi,
    I found a difference between v3.9.10 and 3.11.0 :
    During TLS handshake procedure, if ASN_NO_SIGNER_E appear, the behavior of these two version are different.
   In v3.9.10,  TLS handshake will be ok finally.
   In v3.11.0,   TLS handshake will shutdown immediately.

   Why?
   Could you please explain, in which condition, this error will appear? TLS server request CA certificate in client certificate chain??

   The logic of  DoCertificate() function is totally different between these two version, currently, I can't fully understood them.

Share

  • From: Bozeman
  • Registered: 2014-05-09
  • Posts: 777

Re: ASN_NO_SIGNER_E means what??? (during TLS handshake)

Hi cxdinter,

This has never been the case for default behavior. You can easily test this yourself by doing the following:


# test wolfSSL v3.12.0
git clone https://github.com/wolfssl/wolfssl.git
cd wolfssl
./autogen.sh && ./configure && make && ./examples/client/client -h www.google.com -p 443 -g

RESULT: err = -188, ASN no signer error to confirm failure
RESULT: wolfSSL error: wolfSSL_connect failed

#
# test wolfSSL v3.9.10
git checkout v3.9.10-stable
./autogen.sh && ./configure && make && ./examples/client/client -h www.google.com -p 443 -g

RESULT: err = -188, ASN no signer error to confirm failure
RESULT: wolfSSL error: wolfSSL_connect failed

#
# test wolfSSL v3.11.0
git checkout v3.11.0-stable
./autogen.sh && ./configure && make && ./examples/client/client -h www.google.com -p 443 -g

RESULT: err = -188, ASN no signer error to confirm failure
RESULT: wolfSSL error: wolfSSL_connect failed


Is it possible that instead you had introduced a modification to v3.9.10, perhaps a callback override of some sort that would ignore certain errors?

We are aware there was a bug in v3.11.0 where the callback override would NOT ignore errors as intended. This bug was fixed in release 3.12.0. Would you mind running your test with v3.12.0 and see if you encounter the same issue?

Warm Regards,

Kaleb

Kaleb J. Himes's Website

Share