Article View: borland.public.cppbuilder.internet.socket
Article #5127Re: How to set server side authentication mode
From: Lynn
Date: Wed, 06 Oct 2004 23:45
Date: Wed, 06 Oct 2004 23:45
115 lines
5009 bytes
5009 bytes
I start server by using s_server
I got this error:
OpenSSL> s_server -accept 8091 -cert cert.pem -key key.pem -CAfile rootcert.pem
-state -msg -nbio -ssl3
unknown option -msg
usage: s_server [args ...]
-accept arg - port to accept on (default is 4433)
-context arg - set session ID context
-verify arg - turn on peer certificate verification
-Verify arg - turn on peer certificate verification, must have a cert.
-cert arg - certificate file to use, PEM format assumed
(default is server.pem)
-key arg - Private Key file to use, PEM format assumed, in cert file if
not specified (default is server.pem)
-dcert arg - second certificate file to use (usually for DSA)
-dkey arg - second private key file to use (usually for DSA)
-dhparam arg - DH parameter file to use, in cert file if not specified
or a default set of parameters is used
-nbio - Run with non-blocking IO
-nbio_test - test with the non-blocking test bio
-crlf - convert LF from terminal into CRLF
-debug - Print more output
-state - Print the SSL states
-CApath arg - PEM format directory of CA's
-CAfile arg - PEM format file of CA's
-nocert - Don't use any certificates (Anon-DH)
-cipher arg - play with 'openssl ciphers' to see what goes here
-quiet - No server output
-no_tmp_rsa - Do not generate a tmp RSA key
-ssl2 - Just talk SSLv2
-ssl3 - Just talk SSLv3
-tls1 - Just talk TLSv1
-no_ssl2 - Just disable SSLv2
-no_ssl3 - Just disable SSLv3
-no_tls1 - Just disable TLSv1
-no_dhe - Disable ephemeral DH
-bugs - Turn on SSL bug compatibility
-www - Respond to a 'GET /' with a status page
-WWW - Respond to a 'GET /<path> HTTP/1.0' with file ./<path>
-rand file;file;...
error in s_server
OpenSSL> s_server -accept 8091 -cert cert.pem -key key.pem -CAfile rootcert.pem
-state -nbio -ssl3
Loading 'screen' into random state - done
Using default temp DH parameters
Enter PEM pass phrase:
ACCEPT
bad gethostbyaddr
turning on non blocking io
SSL_accept:before/accept initialization
SSL_accept:SSLv3 read client hello A
SSL_accept:SSLv3 write server hello A
SSL_accept:SSLv3 write certificate A
SSL_accept:SSLv3 write server done A
SSL_accept:SSLv3 flush data
SSL_accept:error in SSLv3 read client certificate A
DELAY
SSL_accept:SSLv3 read client key exchange A
SSL_accept:error in SSLv3 read certificate verify A
DELAY
SSL3 alert write:fatal:bad record mac
SSL_accept:error in SSLv3 read certificate verify A
ERROR
3528:error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record
mac:.\ssl\s3_pkt.c:424:
shutting down SSL
CONNECTION CLOSED
ACCEPT
turning on non blocking io
SSL_accept:before/accept initialization
SSL_accept:error in SSLv3 read client hello B
ERROR
3528:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:.\ssl\s3_p
kt.c:297:
shutting down SSL
CONNECTION CLOSED
ACCEPT
The certificate is official from verisign.
If I run server as a windows service:
The application log file:
10/4/2004 1:37:01 PM: SSL status: "before/accept initialization"
10/4/2004 1:37:01 PM: SSL status: "before/accept initialization"
10/4/2004 1:37:01 PM: SSL status: "SSLv2 read client hello A"
And then stop here.
No clue why I got this?
Any suggestion will be helpful
"Remy Lebeau \(TeamB\)" <no.spam@no.spam.com> wrote:
>
>"Lynn" <lai@eagency.com> wrote in message
>news:416478f8$1@newsgroups.borland.com...
>
>> I did this:
>> IdServerInterceptOpenSSL1->SSLOptions->Mode = TIdSSLMode->..
>
>That is not a valid statement. Try this instead:
>
> IdServerInterceptOpenSSL1->SSLOptions->Mode = sslmServer;
>
>> It doesn't allow me to do this, the error is:
>> [C++ Error] Net.cpp(1): Unable to invoke Code Completion
>> due to errors in source code.
>
>Ignore that. That is an IDE error, not a code error. BCB's code completion
>sucks in general. Most people don't even use it since it doesn't work most
>of the time.
>
>
>Gambit
>
>
Technical Details
Message-ID:
<416483ae$1@newsgroups.borland.com>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!news.glorb.com!newsfeed00.sul.t-online.de!newsfeed01.sul.t-online.de!t-online.de!newsgroups.borland.com!not-for-mailReferences:
<416478f8$1@newsgroups.borland.com> <41647b4c$1@newsgroups.borland.com>Show Full Headers
Complete Article Headers
X-Google-Thread: 11508e,3e25a2205a501b9c X-Google-Attributes: gid11508e,public X-Google-Language: ENGLISH,ASCII-7-bit From: "Lynn" <lai@eagency.com> Sender: "Lynn" <lai@eagency.com> Reply-To: "Lynn" <lai@eagency.com> Subject: Re: How to set server side authentication mode Newsgroups: borland.public.cppbuilder.internet.socket X-User-Info: 65.218.213.100 References: <416478f8$1@newsgroups.borland.com> <41647b4c$1@newsgroups.borland.com> NNTP-Posting-Host: 207.105.83.66 Message-ID: <416483ae$1@newsgroups.borland.com> Date: 6 Oct 2004 16:45:50 -0700 X-Trace: newsgroups.borland.com 1097106350 207.105.83.66 (6 Oct 2004 16:45:50 -0700) Lines: 116 Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!news.glorb.com!newsfeed00.sul.t-online.de!newsfeed01.sul.t-online.de!t-online.de!newsgroups.borland.com!not-for-mail