Not able to send client certificate over openssl

Question

I am trying to implement MSRP over TLS, which requires me to do TLS handshaking for msrp port, i.e 2855. At the time of handshaking server is requesting for client certificate as expected. At the client end I have generated the certificate and the private key,however i am unable to send the certificate. I am using Doubango stack to communicate with openssl.

"SSL_CTX_use_certificate_file(contexts[i], transport->tls.ca, SSL_FILETYPE_PEM)" is what I am using to try to set the certificate. I think it gets set properly, since it doesn't throw any error. However, no matter what i do , the certificate is never sent to the server. The Certificates Length is always 0.

Can anyone help me regarding this problem ? These are the steps I am following to generate the client certificate. https://gist.github.com/mtigas/952344

My code to set the certificates is something like this :

#if HAVE_OPENSSL
    {
        int32_t i, ret;
        SSL_CTX* contexts[3] = { tsk_null };

        if(transport->tls.enabled){
            contexts[0] = transport->tls.ctx_client;
            contexts[1] = transport->tls.ctx_server;
        }

        TSK_DEBUG_INFO("ca = %s, pbk = %s, pvk = %s", ca, pbk, pvk);
        for(i = 0; i < sizeof(contexts)/sizeof(contexts[0]); ++i){
            if(!contexts[i]){
                continue;
            }
            SSL_CTX_set_verify(contexts[i], transport->tls.verify ? (SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT) : SSL_VERIFY_NONE, tsk_null);
            TSK_DEBUG_INFO("tls.verify :%d",  transport->tls.verify);
            if(!tsk_strnullORempty(transport->tls.pbk) || !tsk_strnullORempty(transport->tls.pvk) || !tsk_strnullORempty(transport->tls.ca)){
                /* Sets Public key (cert) */
                if((ret = SSL_CTX_use_certificate_file(contexts[i], transport->tls.ca, SSL_FILETYPE_PEM)) != 1) {
                    TSK_DEBUG_ERROR("SSL_CTX_use_certificate_file failed [%d,%s]", ret, ERR_error_string(ERR_get_error(), tsk_null));
                    return -3;
                }
                /*Sets the password of the private key*/
                if(!tsk_strnullORempty(ssl_password)){
                    SSL_CTX_set_default_passwd_cb_userdata(contexts[i], (void*)ssl_password);
                }

                /* Sets Private key (cert) */
                if (!tsk_strnullORempty(transport->tls.pvk) && (ret = SSL_CTX_use_PrivateKey_file(contexts[i], transport->tls.pvk, SSL_FILETYPE_PEM)) != 1) {
                    TSK_DEBUG_ERROR("SSL_CTX_use_PrivateKey_file failed [%d,%s]", ret, ERR_error_string(ERR_get_error(), tsk_null));
                    return -4;
                }
                /* Checks private key */
                if(!tsk_strnullORempty(transport->tls.pvk) && SSL_CTX_check_private_key(contexts[i]) == 0) {
                    TSK_DEBUG_ERROR("SSL_CTX_check_private_key failed [%d,%s]", ret, ERR_error_string(ERR_get_error(), tsk_null));
                    return -5;
                }
                /* Sets trusted CAs and CA file */
                if(!tsk_strnullORempty(transport->tls.ca) && (ret = SSL_CTX_load_verify_locations(contexts[i], transport->tls.ca, /*tlsdir_cas*/tsk_null)) != 1) {
                   TSK_DEBUG_ERROR("SSL_CTX_load_verify_locations failed [%d, %s]", ret, ERR_error_string(ERR_get_error(), tsk_null));
                   return -5;
                }
            }
        }
    }
#endif /* HAVE_OPENSSL */

Since I am not getting any of these errors, I am assuming that the certificates has been properly set. But still when server request for the certificates, the client fails to send it. i.e Certificates Length = 0. Is there a way to peek into openssl if it is throwing any errors? Where can i get the openssl logs. ? Please help or my leaves wouldnt get approved :(

Not able to send client certificate over openssl

Answers (1)

Related Questions