0

Mutual SSL Authentication is working fine while client is sending certificate of zero size. And certificate verify message is also missing. I am amazed how the communication is working fine. I have TCP dump but I can't share due to security policy of our company.

How is it possible that the communication is working although the client is sending a certificate with zero size?

enter image description here

1
  • 3
    This might be dependant on how the server is configured to accept certificates. You need to explain a LOT more before we can answer this.
    – schroeder
    Sep 26, 2015 at 18:30

2 Answers 2

3

A certificate with 0 bytes is sent by the client if the server requests a certificate but the client has no certificate. How the server deals with the empty certificate depends on the configuration:

With apache you can set the option SSLVerifyClient to optional to require a certificate but accept an empty one too. If you instead set it to require it should fail if only an empty certificate gets provided. Other servers have similar options.

1

Optional client certs?

Sounds like your server is enforcing OPTIONAL (and not mandatory) client certs.

http://www.modssl.org/docs/2.1/ssl_reference.html#ToC13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.