Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Can't recieve self-signed certificates from TLS-Attacker on openssl server #191

Open
Borgc opened this issue Jan 6, 2025 · 0 comments
Open

Comments

@Borgc
Copy link

Borgc commented Jan 6, 2025

Using the folowing command to execute client:
java -jar TLS-Client.jar -connect localhost:4433 -config custom.config -workflow_output bad_output.xml -workflow_trace_type FULL -cert ~/test/clint_chain.pem -key ~/test/client_key.pem
Executing server:
openssl s_server -key server.key -cert server_full.pem -CAfile ca.pem -verify 1 -accept 4433 -msg -tls1_3
Have the following result:
From TLS-Attacker: 13:20:14 [main] INFO : DefaultWorkflowExecutor - Workflow executed as planned.
From openssl:

ERROR
40070EBEF77F0000:error:02000086:rsa routines:RSA_verify_PKCS1_PSS_mgf1:last octet invalid:../crypto/rsa/rsa_pss.c:94:
40070EBEF77F0000:error:1C880004:Provider routines:rsa_verify:RSA lib:../providers/implementations/signature/rsa_sig.c:815:
40070EBEF77F0000:error:0A00007B:SSL routines:tls_process_cert_verify:bad signature:../ssl/statem/statem_lib.c:537:
shutting down SSL
CONNECTION CLOSED

custom.config differentiates from tls13.config only these lines:

<clientAuthentication>true</clientAuthentication>
<clientAuthenticationType>CERTIFICATE_BASED</clientAuthenticationType>

Please help me to understand what I'm doing wrong. Please tell me the easiest way to send certificate (I want server to accept it).
xml trace of run:
bad_output.txt
server_log.txt
I tried to connect to this server with openssl s_client and the same certificate configuration, all was ok.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant