Hi,
I have to setup a https connection between two machines (from command line).
I tried to use openssl command as per the below example,
(Please follows the steps 1,2,3,4. Sorry for the lengthy post...)
Server:
========
1. Create a Private CA
------------------------
Change to working directory
$ cd ~/certs
Create a directory structure for openssl to store some stuff in. This may require updating the configuration in /usr/share/ssl/openssl.cnf.
$ mkdir -p DPSI-CA/certs
$ mkdir -p DPSI-CA/crl
$ mkdir -p DPSI-CA/newcerts
$ mkdir -p DPSI-CA/private
$ touch DPSI-CA/index.txt
$ touch DPSI-CA/private/.rand
$ echo 01 >DPSI-CA/serial
Create the self-signed key and cert
$ openssl req -new -x509 -keyout DPSIkey.pem -out DPSIcert.pem -days 3650
Use a good passphrase when prompted for one.
Use reasonable values for the remaining questions
Country Name (2 letter code) [GB]:US
State or Province Name (full name) [Berkshire]:California
Locality Name (eg, city) [Newbury]:Los Angeles
Organization Name (eg, company) [My Company Ltd]
PSI
Organizational Unit Name (eg, section) []:Systems
Common Name (eg, your name or your server's hostname) []:dpsi-corp.com
Email Address []:
The new CA private key will be in DPSIkey.pem. The public key is in DPSIcert.pem
2. Finally start the https server:
----------------------------------
openssl s_server -accept 443 -key server.pem -cert DPSIcert.pem -www
Enter pass phrase for server.pem:
Using default temp DH parameters
ACCEPT
Client:
========
3. Start a client process:
--------------------------
openssl s_client -connect 10.232.228.16:443
CONNECTED(00000003)
depth=0 /C=in/ST=karnataka/L=bangalore/O=motorola/OU=hnm/CN=mme
verify error:num=18:self signed certificate
verify return:1
depth=0 /C=in/ST=karnataka/L=bangalore/O=motorola/OU=hnm/CN=mme
verify return:1
---
Certificate chain
0 s:/C=in/ST=karnataka/L=bangalore/O=motorola/OU=hnm/CN=mme
i:/C=in/ST=karnataka/L=bangalore/O=motorola/OU=hnm/CN=mme
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDEDCCAnmgAwIBAgIJAL4J0PJSnjfhMA0GCSqGSIb3DQEBBQUAMGQxCzAJBgNV
BAYTAmluMRIwEAYDVQQIEwlrYXJuYXRha2ExEjAQBgNVBAcTCWJhbmdhbG9yZTER
MA8GA1UEChMIbW90b3JvbGExDDAKBgNVBAsTA2hubTEMMAoGA1UEAxMDbW1lMB4X
DTA4MTEwODE1MjU1M1oXDTE4MTEwNjE1MjU1M1owZDELMAkGA1UEBhMCaW4xEjAQ
BgNVBAgTCWthcm5hdGFrYTESMBAGA1UEBxMJYmFuZ2Fsb3JlMREwDwYDVQQKEwht
b3Rvcm9sYTEMMAoGA1UECxMDaG5tMQwwCgYDVQQDEwNtbWUwgZ8wDQYJKoZIhvcN
AQEBBQADgY0AMIGJAoGBAOdYjsP9c68EOIOhxpSXOFtuVgDKZ7rWwrimbNHf/0PP
ymo+jbyj7bCWtXE3di36iCSzKySr9FlQDoPze2TG63RiuxsJ+sj4bVIvTlVgxIpJ
OsV3zYB01EgoHRsag5qqcuVJ8aPfyK6jyz38vYMeLYKdauV5Q8IhY7n1lqyp/Xld
AgMBAAGjgckwgcYwHQYDVR0OBBYEFMqlYhVvKuTvDUc23WhuAcZKJXNKMIGWBgNV
HSMEgY4wgYuAFMqlYhVvKuTvDUc23WhuAcZKJXNKoWikZjBkMQswCQYDVQQGEwJp
bjESMBAGA1UECBMJa2FybmF0YWthMRIwEAYDVQQHEwliYW5nYWxvcmUxETAPBgNV
BAoTCG1vdG9yb2xhMQwwCgYDVQQLEwNobm0xDDAKBgNVBAMTA21tZYIJAL4J0PJS
njfhMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAg69t5UxBsTgS+1aD
xwTGJXJp6qjqSkNKEaA3ccVUWCDMVxwyF2g5itC9K8HBr606Ebp5QJvMFJmUn8mX
EiEJ2JtvqNAcCItSosW4bqXbpAJv2FDIk9y8qI17QJHTVEWxX7okgjGxggmTKU4+
RDTd6BygKpFUWTJsMHAVhXr3IQE=
-----END CERTIFICATE-----
subject=/C=in/ST=karnataka/L=bangalore/O=motorola/OU=hnm/CN=mme
issuer=/C=in/ST=karnataka/L=bangalore/O=motorola/OU=hnm/CN=mme
---
No client certificate CA names sent
---
SSL handshake has read 1224 bytes and written 276 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 1024 bit
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1
Cipher : DHE-RSA-AES256-SHA
Session-ID: C1B1CEA206A7F1B319A2BE3E2EC66D5DD283935F4571C97F2E0D5882D9D539A4
Session-ID-ctx:
Master-Key: E806F1FD034FD9929D546518D76AEE9F2F1E87978865061B42C954EED7C81C96ACD4497B90F6B16B475A8082893358EF
Key-Arg : None
Krb5 Principal: None
Start Time: 1226334026
Timeout : 300 (sec)
Verify return code: 18 (self signed certificate)
---
4. Now try to fetch a webpage:
-------------------------------
GET index.html
HTTP/1.0 200 ok
Content-type: text/html
<HTML><BODY BGCOLOR="#ffffff">
<pre>
s_server -accept 443 -key server.pem -cert DPSIcert.pem -www
Ciphers supported in s_server binary
TLSv1/SSLv3
HE-RSA-AES256-SHA TLSv1/SSLv3
HE-DSS-AES256-SHA
TLSv1/SSLv3:AES256-SHA TLSv1/SSLv3:EDH-RSA-DES-CBC3-SHA
TLSv1/SSLv3:EDH-DSS-DES-CBC3-SHA TLSv1/SSLv3
ES-CBC3-SHA
SSLv2
ES-CBC3-MD5 TLSv1/SSLv3
HE-RSA-AES128-SHA
TLSv1/SSLv3
HE-DSS-AES128-SHA TLSv1/SSLv3:AES128-SHA
SSLv2 :RC2-CBC-MD5 TLSv1/SSLv3
HE-DSS-RC4-SHA
TLSv1/SSLv3:EXP-KRB5-RC4-MD5 TLSv1/SSLv3:EXP-KRB5-RC4-SHA
TLSv1/SSLv3:KRB5-RC4-MD5 TLSv1/SSLv3:KRB5-RC4-SHA
TLSv1/SSLv3:RC4-SHA TLSv1/SSLv3:RC4-MD5
SSLv2 :RC4-MD5 TLSv1/SSLv3:KRB5-DES-CBC3-MD5
TLSv1/SSLv3:KRB5-DES-CBC3-SHA SSLv2 :RC4-64-MD5
TLSv1/SSLv3:EXP1024-DHE-DSS-DES-CBC-SHATLSv1/SSLv3:EXP1024-DES-CBC-SHA
TLSv1/SSLv3:EXP1024-RC2-CBC-MD5 TLSv1/SSLv3:KRB5-DES-CBC-MD5
TLSv1/SSLv3:KRB5-DES-CBC-SHA TLSv1/SSLv3:EDH-RSA-DES-CBC-SHA
TLSv1/SSLv3:EDH-DSS-DES-CBC-SHA TLSv1/SSLv3
ES-CBC-SHA
SSLv2
ES-CBC-MD5 TLSv1/SSLv3:EXP1024-DHE-DSS-RC4-SHA
TLSv1/SSLv3:EXP1024-RC4-SHA TLSv1/SSLv3:EXP1024-RC4-MD5
TLSv1/SSLv3:EXP-KRB5-RC2-CBC-MD5 TLSv1/SSLv3:EXP-KRB5-DES-CBC-MD5
TLSv1/SSLv3:EXP-KRB5-RC2-CBC-SHA TLSv1/SSLv3:EXP-KRB5-DES-CBC-SHA
TLSv1/SSLv3:EXP-EDH-RSA-DES-CBC-SHA TLSv1/SSLv3:EXP-EDH-DSS-DES-CBC-SHA
TLSv1/SSLv3:EXP-DES-CBC-SHA TLSv1/SSLv3:EXP-RC2-CBC-MD5
SSLv2 :EXP-RC2-CBC-MD5 TLSv1/SSLv3:EXP-RC4-MD5
SSLv2 :EXP-RC4-MD5
---
Ciphers common between both SSL end points:
DHE-RSA-AES256-SHA DHE-DSS-AES256-SHA AES256-SHA
EDH-RSA-DES-CBC3-SHA EDH-DSS-DES-CBC3-SHA DES-CBC3-SHA
DHE-RSA-AES128-SHA DHE-DSS-AES128-SHA AES128-SHA
DHE-DSS-RC4-SHA RC4-SHA RC4-MD5
EXP1024-DHE-DSS-DES-CBC-SHA EXP1024-DES-CBC-SHA EXP1024-RC2-CBC-MD5
EDH-RSA-DES-CBC-SHA EDH-DSS-DES-CBC-SHA DES-CBC-SHA
EXP1024-DHE-DSS-RC4-SHA EXP1024-RC4-SHA EXP1024-RC4-MD5
EXP-EDH-RSA-DES-CBC-SHA EXP-EDH-DSS-DES-CBC-SHA EXP-DES-CBC-SHA
EXP-RC2-CBC-MD5 EXP-RC4-MD5
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
SSL-Session:
Protocol : TLSv1
Cipher : DHE-RSA-AES256-SHA
Session-ID: C1B1CEA206A7F1B319A2BE3E2EC66D5DD283935F4571C97F2E0D5882D9D539A4
Session-ID-ctx: 01000000
Master-Key: E806F1FD034FD9929D546518D76AEE9F2F1E87978865061B42C954EED7C81C96ACD4497B90F6B16B475A8082893358EF
Key-Arg : None
Krb5 Principal: None
Start Time: 1226332902
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
1 items in the session cache
0 client connects (SSL_connect())
0 client renegotiates (SSL_connect())
0 client connects that finished
1 server accepts (SSL_accept())
0 server renegotiates (SSL_accept())
1 server accepts that finished
0 session cache hits
0 session cache misses
0 session cache timeouts
0 callback cache hits
0 cache full overflows (128 allowed)
---
no client certificate available
</BODY></HTML>
read:errno=0
So finally, i'm struct here trying to figure out what is wrong...
Could anybody help me on this...
Thanks in advance,
Lokesh.C
