2

In our firm I currently have script that connects to an outside vendor on HTTPS, via SSL. The script only performs server authentication. This is it:

use HTML::Parser;
use HTTP::Request::Common;
use LWP::UserAgent;
use XML::Simple;

local $ENV{HTTPS_CERT_FILE} = '../cert/abc.vendor.crt';
local $ENV{HTTPS_PROXY} = 'https://proxy.com:8080';
local $ENV{HTTPS_DEBUG} = 0;
my $vendor_server = 'https:abc.vendor.site.com';

my $xml = "XML code here";

my $request = (POST $vendor_server, Content_Type => 'text/xml; charset=utf-8', Content => $xml);
my $ua = LWP::UserAgent->new();
my $response = $ua->request($request);

if ( $response->is_success() ) {
    return $response;
}
else {
    return "Error message";
}

This is working as needed, but due to firm compliance and security, we now need to make this a 'Mutual Authentication' via self-signed cert. I tried changing the HTTPS_DEBUG to 1 and adding the following 2 lines after it. The 'myserver.crt' is an internally self-signed cert after I created the CSR (I hope I have those details correct, I'm not well versed in SSL, as is evident):

local $ENV{HTTPS_CA_DIR} = '../cert';
local $ENV{HTTPS_CA_FILE} = '../cert/myserver.crt';

But I'm getting the following error when I run the script:

Connecting to abc over SSL and sending POST
SSL_connect:before/connect initialization
SSL_connect:SSLv2/v3 write client hello A
SSL_connect:SSLv3 read server hello A
SSL3 alert write:fatal:unknown CA
SSL_connect:error in SSLv3 read server certificate B
SSL_connect:error in SSLv3 read server certificate B
SSL_connect:before/connect initialization
SSL_connect:SSLv3 write client hello A
SSL_connect:SSLv3 read server hello A
SSL3 alert write:fatal:bad certificate
SSL_connect:error in SSLv3 read server certificate B
SSL_connect:before/connect initialization
SSL_connect:SSLv2 write client hello A
SSL_connect:failed in SSLv2 read server hello A
Ticket FAILED
$VAR1 = '500 SSL negotiation failed: ';

What am I doing wrong?

Thank you for any and all help!

jww
  • 97,681
  • 90
  • 411
  • 885
Namuna
  • 1,030
  • 8
  • 16
  • You need better error reporting. Provide the output of `echo -n | openssl s_client -CAfile foo.crt -connect example.com:443` – daxim May 06 '13 at 22:38
  • @daxim, $> echo -n | openssl s_client -CAfile foo.crt -connect example.com:443 `13142:error:02001002:system library:fopen:No such file or directory:bss_file.c:104:fopen('foo.crt','r')` `13142:error:2006D080:BIO routines:BIO_new_file:no such file:bss_file.c:107:` `13142:error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib:by_file.c:279:` `connect: No route to host` `connect:errno=113` ...Thank you... – Namuna May 07 '13 at 13:57
  • ...And when I use mycert.crt instead of foo, $> echo -n | openssl s_client -CAfile ../etc/wpidev1.crt -connect example.com:443 `connect: No route to host` `connect:errno=29` – Namuna May 07 '13 at 14:04
  • Also see [Origin-Bound Certificates: A Fresh Approach to Strong Client Authentication for the Web](https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final162.pdf) and [The Token Binding Protocol](https://tools.ietf.org/html/draft-ietf-tokbind-protocol). – jww May 05 '16 at 06:30

0 Answers0