I am trying to understand how Certificate Pinning works with Self Signed Certificates. My idea is that a Server with a Self Signed certificate will accept the connections only from the clients that have got the Server Certificate (Certificate Pinning).
I have generated the Server's private key & certificate files using the below command
Server: openssl req -x509 -days 365 -newkey -sha512 rsa:4096 -keyout keyfile.key -out certfile.cert
And then I'm trying to accept a connection with this command
Server: openssl s_server -accept 5000 -key keyfile.key -cert certfile.cert Client:openssl s_client -connect localhost:5000
The connection succeeds but looks like the Server is sending out its certificate during the Handshake which is not what I'm expecting so I have tried the below command
Server: openssl s_server -accept 50020 -key keyfile.key -cert certfile.cert -Verify 0 Client: openssl s_client -connect localhost:50020
Now the client is unable to connect and the server is giving this error:
140736924775432:error:140890C7:SSL routines:ssl3_get_client_certificate:peer did not return a certificate:s3_srvr.c:3269:
I am not sure how to specify the Server certificate file from the Client side. I have copied the Server Certificate (certfile.cert) to the client and tried with the below command but this requires a private key as well.
Client: openssl s_client -connect localhost:50020 -cert certfile.cert
Am I getting confused with Server & Client certificates and is there a way for the Client to specify the Server certificate?