openssl SSL_Connect 出现错误 2
我是这个论坛的新成员。
问题：
我必须将 openssl 集成到我的项目中。项目是使用 gsoap 实现的。
在“r = SSL_connect(soap->ssl)) <= 0)”中 SSL_connect 调用无法与服务器建立连接。服务器和客户端都在本地主机中
我看到服务器已准备好接受连接，如下所示使用 netstat 命令建立的连接：
TCP cspxppgudepu:15000 cspxppgudepu.com:0 LISTENING TCP cspxppgudepu:15000 localhost:2864 ESTABLISHED
15000 以上端口用于服务器。
下面是客户端连接： TCP cspxppgudepu:16000 cspxppgudepu.com:0 LISTENING
但 SSL_connect 无法连接。它总是失败，返回代码 -1 & err 2.
没有SSL连接，简单的TCP连接，两端都能够连接和通信。以下为无 SSL 的网络配置设置
我的 openssl 网络配置设置：
<NetworkConfig>
<Server Location="https://127.0.0.1:15000" />
<Client Location="https://127.0.0.1:16000" />
我已经采用了客户端和客户端。服务器身份验证为 false。
提前致谢。 普拉迪普·雷迪。
更新，
SSL_connect 因 SSL_ERROR_WANT_READ 失败。我知道客户端正在等待服务器写入一些数据。但我不明白在服务器端更改代码的内容。
请让我知道如何解决这个问题。
如果我在服务器和客户端上都提供根证书 cacert.pem 并且身份验证设置为 true，则 SSL 通信现在工作正常。和soap_ssl_server_context() 分别调用。 这次握手失败，客户端出现以下错误：“error:14090086:lib(20):func(144):reason(134)” 和服务器端“错误：14094418：lib（20）：func（148）：reason（1048）”
但是客户端证书和服务器证书都是从命令下面的根证书“cacert.pem”生成的。
命令：openssl x509 -req -in clientreq.pem -sha1 -extensions usr_cert -CA root.pem -CAkey root.pem -CAcreateserial -out clientcert.pem -days 1095 和 命令：openssl x509 -req -in serverreq.pem -sha1 -extensions usr_cert -CA root.pem -CAkey root.pem -CAcreateserial -out servercert.pem -days 1095 错误我理解为“错误：14094418：SSL例程：SSL3_READ_BYTES：tlsv1警报未知ca”。 但两个证书都来自同一根 CA cacertpem。如果您有任何修复，请提供。 我无法编辑帖子，因此发布答案。 谢谢， 普拉迪普。
Iam a new member into this forum.
Issue:
I have to integrate openssl in my project.project is implemented with gsoap.
in "r = SSL_connect(soap->ssl)) <= 0)"
SSL_connect call is unable to make a connection to the server.Both server and client are in local host
I see server is ready to accept the connections, as I see below connection established with netstat command:
TCP cspxppgudepu:15000 cspxppgudepu.com:0 LISTENING
TCP cspxppgudepu:15000 localhost:2864 ESTABLISHED
Above 15000 port is for server.
Below is client connection:
TCP cspxppgudepu:16000 cspxppgudepu.com:0 LISTENING
But SSL_connect is unable to connect.It is always failing with return code -1 & err 2.
With out SSL connection,simple TCP conection, both ends are able to connect and communicate. Below network configuration settings for without SSL
My network configuration settings for with openssl:
<NetworkConfig>
<Server Location="https://127.0.0.1:15000" />
<Client Location="https://127.0.0.1:16000" />
I have taken both client & server authentication to false.
Thanks in advance.
Pradeep Reddy.
An update,
SSL_connect is failing with SSL_ERROR_WANT_READ.I understand that client is waiting on server to write some data.But I dont understand what to change code in server side.
please let me know, how to go from this.
SSL communcation is working fine now if I give root certificate cacert.pem on both server and client and authentication is set to true.Instead of giving the same root certificate cacert.pem I have given clientcert.pem and servercert.pem in soap_ssl_client_context() and soap_ssl_server_context() calls respectively.
This time Handshake is failed with below error at client side:"error:14090086:lib(20):func(144):reason(134)"
and server side "error:14094418:lib(20):func(148):reason(1048)"
But both client certificate and server certificate are generated from root certificate "cacert.pem" below comands.
Command:openssl x509 -req -in clientreq.pem -sha1 -extensions usr_cert -CA root.pem -CAkey root.pem -CAcreateserial -out clientcert.pem -days 1095
and
Command:openssl x509 -req -in serverreq.pem -sha1 -extensions usr_cert -CA root.pem -CAkey root.pem -CAcreateserial -out servercert.pem -days 1095
error I understood as "error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca".
But both certificates are from same root CA cacertpem. Please provide if you have any fix.
I could not edit the post, so posting the answer.
Thanks,
Pradeep.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
首先，您必须在调用
SSL_connect()之前建立 TCP 连接。SSL_connect()只是设置 SSL 会话，并且它期望您使用SSL_set_fd()设置的文件描述符已连接到另一端。其次，您必须在服务器端调用
SSL_accept()（同样，在底层 TCP 连接已经建立之后）。Firstly, you must establish the TCP connection before you call
SSL_connect().SSL_connect()just sets up the SSL session, and it expects that the file descriptor you set withSSL_set_fd()is already connected to the other side.Secondly, you must call
SSL_accept()on the server side (again, after the underlying TCP connection has already been set up).您是否通过以下方式设置了 CA 在您的客户端代码上受信任：
您可以在 OpenSSL 文档中找到有关如何使用该方法的信息 - 它非常简单：
http://www.openssl.org/docs/ssl/SSL_CTX_load_verify_locations.html
Did you set that the CA is trusted on your client code with:
You can find at OpenSSL documentation about how to use that method - it's pretty straightforward:
http://www.openssl.org/docs/ssl/SSL_CTX_load_verify_locations.html