Client authentication #192
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
this contains the server side as well, and works locally with openssl (both sides, s_client and s_server), the whole PR now fixes #171 🎉 |
This was referenced Oct 6, 2014
hannesm
changed the title
hannesm
force-pushed
the
client_auth
branch
2 times, most recently
from
b796ef6
to
46f7593
Compare
…tate and transitions
Conflicts: lib/config.ml lib/config.mli
once again, the format is slightly different in TLS_1_2 (signature and hash algorithms are included) also fix parsing of cas, especially: ``(calength + 2) <> len buf`` instead of ``calength <> (len buf) + 2``
now that we export parse_certificate_request(_1_2)
… CertificateVerify
- parse message depending on protocol_version - require RSA_SIGN to be included in types - set client_auth field to true - set own_certificate and own_private_key for further use adjust server_hello_done handler - send certificate and certificateVerify message (if requested and demanded and provided) - send empty certificate if certificaterequest occured and no certificate was found - no certificateverify -> continue handshake as usual
…ncoded); if none_if_empty provided, return a 0-length buffer
- if authenticator is configured, ask for a client certificate (send CertificateRequest) - if certificate is provided by client, validate the chain (using the authenticator) - verify the signature (using the client certificate key) of the CertificateVerify message - store client certificate in session.peer_certificate (and trust anchor in session.trust_anchor) the application still needs to decide whether the session.peer_certificate is good for it (it might be empty!!!)
… a client certificate
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
this builds on top of SNI! It might not yet be ready for merging (esp. the modification to echo_client should not be merged). any comments are welcome (addresses first half of #171)