7

I'm trying to set up a listener to check if an application checks the server's certificate (I'm strongly assuming it is not). So I've created a self-signed certificate fake.pem for a listener and am trying to connect to it from the application.

socat openssl-listen:443,reuseaddr,cert=./fake.pem echo

The packets I capture in Wireshark are

Client (C) -> Server(S): SYN
S->C: SYN-ACK
C->S: ACK
C->S: sClient Hello
S->C: ACK
S->C: Server Hello, Certificate, Server Key Exchange, Certificate Request, Server Hello Done
C->S: Certificate, Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message
S->C: Alert (Level: Fatal, Description: handshake Failure)
S->C: RST ACK`

I thought that socat only checks against the option cafile (at least that's what it says in the manpage). Does it perform additional checks I could disable?

Could there be other good reasons why the server side would complain besides not a valid certificate from the client?

9

The problem was the certificate request part. The client application didn't send any certificate and if option verify=0 is added to the socat listener it works fine. verify is set to True by default.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.