Caanoo / WIZ Caanoo Curl : Openssl Certificate Verification Problem

[scachi]

Hi,

I am trying to get ssl connections working with curl on my caanoo :

./curl https://www.amazon.de --cacert certs/cacert.pem --capath certs  -v 
* About to connect() to www.amazon.de port 443 (#0)
*   Trying 178.236.4.28... connected
* Connected to www.amazon.de (178.236.4.28) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: certs/cacert.pem
  CApath: certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS alert, Server hello (2):
* error:04091077:rsa routines:INT_RSA_VERIFY:wrong signature length
* Closing connection #0
curl: (35) error:04091077:rsa routines:INT_RSA_VERIFY:wrong signature length

I can't find any helpful informations what the cause of this problem might be.
I have tried it with gph libs, compiled my own openssl lib, tried different ca-bundle files..always with the same negative result.

Any ideas ?

 

[scachi]

I have compiled openssl and libcurl .
Now https to https://mozilla.org seems to work:

About to connect() to www.mozilla.org port 443 (#0)
*   Trying 63.245.209.11... connected
* Connected to www.mozilla.org (63.245.209.11) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: /mnt/sd/apps/netsurf/certs/ca-bundle.crt
  CApath: none
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using RC4-SHA
* Server certificate:
* 	 subject: serialNumber=vhiCn2kbHVxmzSKeR6dKZqOK/187nnD0; C=US; ST=California; L=Mountain View; O=Mozilla Corporation; OU=Secure Web Server; CN=*.mozilla.org
* 	 start date: 2009-12-01 03:42:54 GMT
* 	 expire date: 2011-12-02 10:55:27 GMT
* 	 common name: *.mozilla.org (matched)
* 	 issuer: C=US; O=Equifax; OU=Equifax Secure Certificate Authority
* 	 SSL certificate verify ok.
> GET / HTTP/1.1
> User-Agent: curl/7.21.7 (arm-gph-linux-gnueabi) libcurl/7.21.7 OpenSSL/1.0.0e zlib/1.2.3
> Host: www.mozilla.org
> Accept: */*

But for other pages I get a certificate error:

./curl https://www.amazon.de  
curl: (60) SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

If I use the same .crt file on my linux system it works. I have no clue what the problem is.

 

[crow_riot]

Well i wish i could help you here. I've done very little with openssl and the only thing i remember is that their documentation is PITA. Hope you get it right!

 

[sebt3]

It sound as if the crt contained in openssl distribution does not contain all the public keys for all the officials CA while your distribution have fixed that.
Use the good one

 

[scachi]

Got it working now.

Stupid me..setting the system time to the current date/time is crucial for a working verification :rolleyes:
I should have checked that earlier. I didn't now how to check the certificate directly with openssl so I used curl as libcurl is
used by netsurf. Checking it directly within openssl gave me very helpful information "Verify return code: 9 (certificate is not yet valid)".

 

[kayuz]

Got it working now.

Stupid me..setting the system time to the current date/time is crucial for a working verification
I should have checked that earlier. I didn't now how to check the certificate directly with openssl so I used curl as libcurl is
used by netsurf. Checking it directly within openssl gave me very helpful information "Verify return code: 9 (certificate is not yet valid)".

wow wow wow! got ssl working! good