• [^] # Re: SSL / Debug

    Posté par . En réponse au message OpenLDAP / SSL. Évalué à 1.

    Pour le openssl s_client j'obtient ceci :

    CONNECTED(00000003)
    SSL_connect:before/connect initialization
    SSL_connect:SSLv2/v3 write client hello A
    SSL_connect:SSLv3 read server hello A
    depth=0 /C=BE/ST=Belgium/L=Brussel/O=company/OU=Operations/CN=Henry-Nicolas Tourneur/emailAddress=hntourneur@company.com
    verify error:num=18:self signed certificate
    verify return:1
    depth=0 /C=BE/ST=Belgium/L=Brussel/O=company/OU=Operations/CN=Henry-Nicolas Tourneur/emailAddress=hntourneur@company.com
    verify error:num=7:certificate signature failure
    verify return:1
    depth=0 /C=BE/ST=Belgium/L=Brussel/O=company/OU=Operations/CN=Henry-Nicolas Tourneur/emailAddress=hntourneur@company.com
    verify return:1
    SSL_connect:SSLv3 read server certificate A
    SSL_connect:SSLv3 read server done A
    SSL_connect:SSLv3 write client key exchange A
    SSL_connect:SSLv3 write change cipher spec A
    SSL_connect:SSLv3 write finished A
    SSL_connect:SSLv3 flush data
    SSL_connect:SSLv3 read finished A
    ---
    Certificate chain
    0 s:/C=BE/ST=Belgium/L=Brussel/O=company/OU=Operations/CN=Henry-Nicolas Tourneur/emailAddress=hntourneur@company.com
    i:/C=BE/ST=Belgium/L=Brussel/O=company/OU=Operations/CN=Henry-Nicolas Tourneur/emailAddress=hntourneur@company.com
    -----BEGIN CERTIFICATE-----
    MIICxzCCAjACCQDfaEwiLaljYTANBgkqhkiG9w0BAQUFADCBpzELMAkGA1UEBhMC
    QkUxEDAOBgNVBAgTB0JlbGdpdW0xEDAOBgNVBAcTB0JydXNzZWwxFDASBgNVBAoT
    C01BQyBUZWxlY29tMRMwEQYDVQQLEwpPcGVyYXRpb25zMR8wHQYDVQQDExZIZW5y
    eS1OaWNvbGFzIFRvdXJuZXVyMSgwJgYJKoZIhvcNAQkBFhlobnRvdXJuZXVyQG1h
    Y3RlbGVjb20uY29tMB4XDTA5MDkwOTE0NTgwMFoXDTE5MDkwNzE0NTgwMFowgacx
    CzAJBgNVBAYTAkJFMRAwDgYDVQQIEwdCZWxnaXVtMRAwDgYDVQQHEwdCcnVzc2Vs
    MRQwEgYDVQQKEwtNQUMgVGVsZWNvbTETMBEGA1UECxMKT3BlcmF0aW9uczEfMB0G
    A1UEAxMWSGVucnktTmljb2xhcyBUb3VybmV1cjEoMCYGCSqGSIb3DQEJARYZaG50
    b3VybmV1ckBtYWN0ZWxlY29tLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkC
    gYEA3ZT5ESk9T6pC5NeZB0wH1e+1hdiXPX4HSKTJklnUW+C2lQMvPLSGgVx3gNKk
    alAdBL7nE+7qlnSM88MPNetA8H4U4FeVgiY/xNFnuPW9/90PX79jf9Rvjvq5IhmN
    XOtf/EhPhpgeOWnm5RgDoCSS4hZEZrRaQW5bP3eodo+47L8CAwEAATANBgkqhkiG
    9w0BAQUFAAOBgQC9hU5JY539oGZGXCOxHFHbAWqGInt8wkOPNdLqLZaqIVqS64Of
    L2Ovo9WQ0qwST48XAmdMvD5euMqNBbtdgeT9D7YzYkGaSx3HvR7vzeC/Fgn8OKM9
    Z1CFx+BRlOR3nQ5lcH/svC/qEErmS9xCeiqB0zSZIc0jpMlEZ4Q3xo6v9Q==
    -----END CERTIFICATE-----
    ---
    Server certificate
    subject=/C=BE/ST=Belgium/L=Brussel/O=company/OU=Operations/CN=Henry-Nicolas Tourneur/emailAddress=hntourneur@company.com
    issuer=/C=BE/ST=Belgium/L=Brussel/O=company/OU=Operations/CN=Henry-Nicolas Tourneur/emailAddress=hntourneur@company.com
    ---
    No client certificate CA names sent
    ---
    SSL handshake has read 1069 bytes and written 316 bytes
    ---
    New, TLSv1/SSLv3, Cipher is AES256-SHA
    Server public key is 1024 bit
    Compression: NONE
    Expansion: NONE
    SSL-Session:
    Protocol : TLSv1
    Cipher : AES256-SHA
    Session-ID: 68435F9BDB62DCB32FB193A8140C92258102A91A2171DF0C3C6DE89BE7F264E5
    Session-ID-ctx:
    Master-Key: CD789CABAF1F4D8728365377CF086A4EAD9E97268DBB8360051B5F66F29DF973FAA5DC66AD0E6D12FA47408CF296AAAA
    Key-Arg : None
    Start Time: 1252573843
    Timeout : 300 (sec)
    Verify return code: 7 (certificate signature failure)
    ---



    Pour le ldapsearch -ZZ j'obtient ça :
    ldap_start_tls: Can't contact LDAP server (-1)

    A noter aussi que si je fait openssl verify -CAfile cacert.pem servercert.pem, j'ai :

    servercert.pem: /C=BE/ST=Belgium/L=Brussel/O=company/OU=Operations/CN=Henry-Nicolas Tourneur/emailAddress=hntourneur@company.com
    error 18 at 0 depth lookup:self signed certificate
    /C=BE/ST=Belgium/L=Brussel/O=company/OU=Operations/CN=Henry-Nicolas Tourneur/emailAddress=hntourneur@company.com
    error 7 at 0 depth lookup:certificate signature failure
    3416:error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01:rsa_pk1.c:100:
    3416:error:04067072:rsa routines:RSA_EAY_PUBLIC_DECRYPT:padding check failed:rsa_eay.c:699:
    3416:error:0D0C5006:asn1 encoding routines:ASN1_item_verify:EVP lib:a_verify.c:168:



    C'est un certificat autosigné, ça semble poser des soucis du côté de la signature. Le tuto que j'ai renseigné ne serait pas correct sur la partie des certificats ?