I'm running into a weird issue when trying to perform a TLS connection.

I know that my machine is not accepting the server certificate from looking at the wireshark logs.

enter image description here

This is telling me I dont trust the CA that signed the server Certificate, but I have uploaded the Certificate that signed the Sever certificate into my Trusted Root Certificate Authority Store.

I have even downloaded the certificate that the server is sending me and examined the path of it to make sure it was trusted. I can see under the Certificate status that the Certificate is OK.

I'm not exactly sure on why my client machine is refusing the connection from the server certificate.

  • 1
    Can the connection be established, i.e. is the handshake working with the openssl test client? if not, what is the error at protocoll level? From this screenhot, it cannot be established that it's a trust issue with the CA, it could be something completely different - maybe a client that does not speak tls (correctly). What client are you using and what's the actual error message? – Tobi Nary Mar 3 '17 at 16:07
  • I'm setting up a local webapp to talk to a services within my intranet within visual studio so my process should have access to my machines certificate store. using the openssl s_client I return errors number 20 (unable to get local issuer certificate) and error number 21 (unable to verify the first certificate. – McFrank Mar 3 '17 at 17:31
  • Looks like i was not adding in the -CAfile flag. This s_client call now works with a pem certificate as the signing authority – McFrank Mar 3 '17 at 18:21

There are many reasons why a TLS connection would fail other than Trust. From the screenshot you provided, it is not obvious that TLS negotiation failure is caused by "my machine is not accepting the server certificate". To determine exact trust issue you need to look into alerts (SSL Alert Messages) and see if it states bad certificate (code 42), unsupported certificate (43), certificate revoked (44), certificate expired (45), or certificate unknown (46). In Wireshark, this would look like Alert (Level: Fatal, Description: Bad Certificate).

Specifically, looking at the packet capture, the last message is Server Hello, Certificate, _Certificate Request_, Server Hello Done. This tells me that the server is configured to request mutual authentication. Therefore, the next expected response is Certificate Message from the client followed by Certificate Verify. I do not see that in your screenshot. Alternatively, Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message as some clients are configured to ignore mutual authentication and server could be configured to allow such behavior.

I think the likely cause of handshake failure here is that your client does not support/is not configured for mutual certificate-based authentication.

  • Looks like windows 10 doesn't allow my administrator user account to fall in the administrator group that was allowed access to the private key. Thus a configuration error. – McFrank Mar 3 '17 at 19:39
  • 1
    for more information in case somone else comes along I was running my web application calling another web service in visual studio. All visual studio process are run under the user account. Even though my user account is an administrator, The certificate store was not allowing me access to the private key. I had to add my user account to be able to access the private key – McFrank Mar 3 '17 at 19:41
  • In TLS if server sends CertReq the (conforming) client must send a Cert message, although if it can't or chooses not to authenticate, the client Cert message contains a length=0 sequence containing no certificates. (SSL allowed client to omit the Cert message entirely in this case.) And in most cases the sequence is client Cert, ClientKX, CertVerify, CCS, Encrypted(Finished). – dave_thompson_085 Mar 4 '17 at 12:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.