ssl - 如何与openssl建立相互安全连接？

Question

我尝试与服务器建立相互(2 种)安全连接。我应该在非 SSL3 模式下使用客户端证书(CRT 文件类型)。

命令:

openssl s_client -connect example.com:443 -no_ssl3 -cert client.crt

输出:

140386483435168:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:703:Expecting: ANY PRIVATE KEY

当我不使用必需的证书时，它有不同的输出。

命令:

openssl s_client -connect example.com:443 -no_ssl3 

输出:

CONNECTED(00000003)
depth=2 DC = com, DC = example, O = blah, OU = blah, CN = blah
verify error:num=19:self signed certificate in certificate chain
verify return:0
140181058492064:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1262:SSL alert number 40
140181058492064:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177:
---
Certificate chain
 0 s:/C=US/ST=blaaaah/L=blaaaah/O=blaaaah/OU=blaaaah/CN=example.com
   i:/DC=com/DC=example/O=blah/OU=blah/CN=blah
 1 s:/DC=com/DC=example/O=blah/OU=blah/CN=blah
   i:/DC=com/DC=example/O=blah/OU=blah/CN=blah
 2 s:/DC=com/DC=example/O=blah/OU=blah/CN=blah
   i:/DC=com/DC=example/O=blah/OU=blah/CN=blah
---
Server certificate
-----BEGIN CERTIFICATE-----
blaaaah
-----END CERTIFICATE-----
subject=/C=US/ST=blaaaah/L=blaaaah/O=blaaaah/OU=blaaaah/CN=example.com
issuer=/DC=com/DC=blaaaah/O=blaaaah/OU=blah/CN=blaaaah
---
Acceptable client certificate CA names
/DC=com/DC=example/O=blaaaah/OU=blaaaah/CN=blaaaah

.
.
.
.etc.

---
SSL handshake has read 5458 bytes and written 330 bytes
---
New, TLSv1/SSLv3, Cipher is DES-CBC3-SHA
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DES-CBC3-SHA
    Session-ID: B1259877305945E0AAAAAA2FE38DA46B5A5813F6513D0DC5BF92FB6AD32287569
    Session-ID-ctx: 
    Master-Key: blaaaah
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1450452192
    Timeout   : 300 (sec)
    Verify return code: 19 (self signed certificate in certificate chain)
---

怎么了？

Answer 1

如错误消息所述，您需要证书的私钥(可能还有密码，如果已加密 - 您会收到提示)。因此，您需要添加 -key myPrivateKey.key，假设它是 PEM 编码的。