🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: borland.public.cppbuilder.internet.socket
Article #5127

Re: How to set server side authentication mode

#5127
From: Lynn
Date: Wed, 06 Oct 2004 23:45
115 lines
5009 bytes
I start server by using s_server
I got this error:
OpenSSL> s_server -accept 8091 -cert cert.pem -key key.pem -CAfile rootcert.pem
-state -msg -nbio -ssl3
unknown option -msg
usage: s_server [args ...]

 -accept arg   - port to accept on (default is 4433)
 -context arg  - set session ID context
 -verify arg   - turn on peer certificate verification
 -Verify arg   - turn on peer certificate verification, must have a cert.
 -cert arg     - certificate file to use, PEM format assumed
                 (default is server.pem)
 -key arg      - Private Key file to use, PEM format assumed, in cert file if
                 not specified (default is server.pem)
 -dcert arg    - second certificate file to use (usually for DSA)
 -dkey arg     - second private key file to use (usually for DSA)
 -dhparam arg  - DH parameter file to use, in cert file if not specified
                 or a default set of parameters is used
 -nbio         - Run with non-blocking IO
 -nbio_test    - test with the non-blocking test bio
 -crlf         - convert LF from terminal into CRLF
 -debug        - Print more output
 -state        - Print the SSL states
 -CApath arg   - PEM format directory of CA's
 -CAfile arg   - PEM format file of CA's
 -nocert       - Don't use any certificates (Anon-DH)
 -cipher arg   - play with 'openssl ciphers' to see what goes here
 -quiet        - No server output
 -no_tmp_rsa   - Do not generate a tmp RSA key
 -ssl2         - Just talk SSLv2
 -ssl3         - Just talk SSLv3
 -tls1         - Just talk TLSv1
 -no_ssl2      - Just disable SSLv2
 -no_ssl3      - Just disable SSLv3
 -no_tls1      - Just disable TLSv1
 -no_dhe       - Disable ephemeral DH
 -bugs         - Turn on SSL bug compatibility
 -www          - Respond to a 'GET /' with a status page
 -WWW          - Respond to a 'GET /<path> HTTP/1.0' with file ./<path>
 -rand file;file;...
error in s_server
OpenSSL> s_server -accept 8091 -cert cert.pem -key key.pem -CAfile rootcert.pem
-state -nbio -ssl3
Loading 'screen' into random state - done
Using default temp DH parameters
Enter PEM pass phrase:
ACCEPT
bad gethostbyaddr
turning on non blocking io
SSL_accept:before/accept initialization
SSL_accept:SSLv3 read client hello A
SSL_accept:SSLv3 write server hello A
SSL_accept:SSLv3 write certificate A
SSL_accept:SSLv3 write server done A
SSL_accept:SSLv3 flush data
SSL_accept:error in SSLv3 read client certificate A
DELAY
SSL_accept:SSLv3 read client key exchange A
SSL_accept:error in SSLv3 read certificate verify A
DELAY
SSL3 alert write:fatal:bad record mac
SSL_accept:error in SSLv3 read certificate verify A
ERROR
3528:error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record
 mac:.\ssl\s3_pkt.c:424:
shutting down SSL
CONNECTION CLOSED
ACCEPT
turning on non blocking io
SSL_accept:before/accept initialization
SSL_accept:error in SSLv3 read client hello B
ERROR
3528:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:.\ssl\s3_p
kt.c:297:
shutting down SSL
CONNECTION CLOSED
ACCEPT

The certificate is official from verisign.
If I run server as a windows service:
The application log file:
10/4/2004 1:37:01 PM: SSL status: "before/accept initialization"
10/4/2004 1:37:01 PM: SSL status: "before/accept initialization"
10/4/2004 1:37:01 PM: SSL status: "SSLv2 read client hello A"
And then stop here.

No clue why I got this?
Any suggestion will be helpful

"Remy Lebeau \(TeamB\)" <no.spam@no.spam.com> wrote:
>
>"Lynn" <lai@eagency.com> wrote in message
>news:416478f8$1@newsgroups.borland.com...
>
>> I did this:
>>  IdServerInterceptOpenSSL1->SSLOptions->Mode = TIdSSLMode->..
>
>That is not a valid statement.  Try this instead:
>
>    IdServerInterceptOpenSSL1->SSLOptions->Mode = sslmServer;
>
>> It doesn't allow me to do this, the error is:
>> [C++ Error] Net.cpp(1): Unable to invoke Code Completion
>> due to errors in source code.
>
>Ignore that.  That is an IDE error, not a code error.  BCB's code completion
>sucks in general.  Most people don't even use it since it doesn't work most
>of the time.
>
>
>Gambit
>
>
Technical Details
Message-ID: <416483ae$1@newsgroups.borland.com>
Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!news.glorb.com!newsfeed00.sul.t-online.de!newsfeed01.sul.t-online.de!t-online.de!newsgroups.borland.com!not-for-mail
References: <416478f8$1@newsgroups.borland.com> <41647b4c$1@newsgroups.borland.com>

Show Full Headers
Complete Article Headers
X-Google-Thread: 11508e,3e25a2205a501b9c
X-Google-Attributes: gid11508e,public
X-Google-Language: ENGLISH,ASCII-7-bit
From: "Lynn" <lai@eagency.com>
Sender: "Lynn" <lai@eagency.com>
Reply-To: "Lynn" <lai@eagency.com>
Subject: Re: How to set server side authentication mode
Newsgroups: borland.public.cppbuilder.internet.socket
X-User-Info: 65.218.213.100     
References: <416478f8$1@newsgroups.borland.com> <41647b4c$1@newsgroups.borland.com>
NNTP-Posting-Host: 207.105.83.66
Message-ID: <416483ae$1@newsgroups.borland.com>
Date: 6 Oct 2004 16:45:50 -0700
X-Trace: newsgroups.borland.com 1097106350 207.105.83.66 (6 Oct 2004 16:45:50 -0700)
Lines: 116
Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!news.glorb.com!newsfeed00.sul.t-online.de!newsfeed01.sul.t-online.de!t-online.de!newsgroups.borland.com!not-for-mail