I'm looking for some clarification around the trust requirements (if any) of client certificates.
I'm working with a third party to access their services via Mutual TLS.
I generate a CSR, send it to the third-party, they send me a certificate (which they've generated using their own CA). It's a single certificate. I haven't been provided with any intermediate certificates - as I'm assuming you don't need these to issue client certificate authenticated requests.
When I attempt to connect with this certificate, I get a handshake failure:
openssl s_client -connect the-server.com:443 -cert the-cert.pem -key the-key.pem -state CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv2/v3 write client hello A SSL_connect:SSLv3 read server hello A depth=2 /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5 verify error:num=20:unable to get local issuer certificate verify return:0 SSL_connect:SSLv3 read server certificate A SSL_connect:SSLv3 read server certificate request A SSL_connect:SSLv3 read server done A SSL_connect:SSLv3 write client certificate A SSL_connect:SSLv3 write client key exchange A SSL_connect:SSLv3 write certificate verify A SSL_connect:SSLv3 write change cipher spec A SSL_connect:SSLv3 write finished A SSL_connect:SSLv3 flush data SSL3 alert read:fatal:handshake failure SSL_connect:failed in SSLv3 read finished A 78460:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:/BuildRoot/Library/Caches/com.apple.xbs/Sources/OpenSSL098/OpenSSL098-59/src/ssl/s3_pkt.c:1145:SSL alert number 40 78460:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:/BuildRoot/Library/Caches/com.apple.xbs/Sources/OpenSSL098/OpenSSL098-59/src/ssl/s23_lib.c:185:
I'm being told that it's failing as: 'the pem files do not contain the public CA certs that signed the client certificate' however if this was the case, would the client even send the certificate (as it appears to be doing so in the TLS negotiation steps above) if it was the case that it needed to trust it?