Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Mutual SSL Authentication is working fine while client is sending certificate of zero size. And certificate verify message is also missing. I am amazed how the communication is working fine. I have TCP dump but I can't share due to security policy of our company.
How is it possible that the communication is working although the client is sending a certificate with zero size?
A certificate with 0 bytes is sent by the client if the server requests a certificate but the client has no certificate. How the server deals with the empty certificate depends on the configuration:
With apache you can set the option SSLVerifyClient to optional to require a certificate but accept an empty one too. If you instead set it to require it should fail if only an empty certificate gets provided. Other servers have similar options.
Optional client certs?
Sounds like your server is enforcing OPTIONAL (and not mandatory) client certs.
