Question

我尝试与服务器建立相互（2路）安全连接。我应该在没有SSL3模式的情况下使用客户端证书（CRT文件类型）。

命令：的

openssl s_client -connect example.com:443 -no_ssl3 -cert client.crt

输出：

140386483435168:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:703:Expecting: ANY PRIVATE KEY

当我没有使用所需的证书时，它会有不同的输出。

命令：的

openssl s_client -connect example.com:443 -no_ssl3

输出：

CONNECTED(00000003)
depth=2 DC = com, DC = example, O = blah, OU = blah, CN = blah
verify error:num=19:self signed certificate in certificate chain
verify return:0
140181058492064:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1262:SSL alert number 40
140181058492064:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177:
---
Certificate chain
 0 s:/C=US/ST=blaaaah/L=blaaaah/O=blaaaah/OU=blaaaah/CN=example.com
   i:/DC=com/DC=example/O=blah/OU=blah/CN=blah
 1 s:/DC=com/DC=example/O=blah/OU=blah/CN=blah
   i:/DC=com/DC=example/O=blah/OU=blah/CN=blah
 2 s:/DC=com/DC=example/O=blah/OU=blah/CN=blah
   i:/DC=com/DC=example/O=blah/OU=blah/CN=blah
---
Server certificate
-----BEGIN CERTIFICATE-----
blaaaah
-----END CERTIFICATE-----
subject=/C=US/ST=blaaaah/L=blaaaah/O=blaaaah/OU=blaaaah/CN=example.com
issuer=/DC=com/DC=blaaaah/O=blaaaah/OU=blah/CN=blaaaah
---
Acceptable client certificate CA names
/DC=com/DC=example/O=blaaaah/OU=blaaaah/CN=blaaaah

.
.
.
.etc.

---
SSL handshake has read 5458 bytes and written 330 bytes
---
New, TLSv1/SSLv3, Cipher is DES-CBC3-SHA
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DES-CBC3-SHA
    Session-ID: B1259877305945E0AAAAAA2FE38DA46B5A5813F6513D0DC5BF92FB6AD32287569
    Session-ID-ctx: 
    Master-Key: blaaaah
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1450452192
    Timeout   : 300 (sec)
    Verify return code: 19 (self signed certificate in certificate chain)
---

有什么不对？

Answer 1

正如错误消息所述，您需要私钥用于您的证书（可能还有密码，如果它已加密 - 您将收到提示）。因此，您需要添加-key myPrivateKey.key，假设它是PEM编码的。

如何与openssl建立相互安全的连接？

1 个答案: