SSL Connect error with libcurl after SKIP_PEER_VERIFICATION?

Question

I am trying to connect to server which demands client authentication. I am doing it in C with libcurl. The problem is when I try to connect I get: curl_easy_perform() failed: SSL connect error I read that I should add server certificate to ca-bundle.crt; however server's certificate is self signed so when I add it to ca-bundle I got SSL peer certificate or SSH remote key was not OK. After that I tried do set CURLOPT_SSL_VERIFYPEER to false; but I got the first error curl_easy_perform() failed: SSL connect error This is my current code:

#define SKIP_HOSTNAME_VERIFICATION
#define SKIP_PEER_VERIFICATION

int authenticate(CURL *curl) {
    char* pathToCert = "sslCert.pem";
    char* pathToKey = "privateKey.pem";
    curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "PEM");
    int res = curl_easy_setopt(curl, CURLOPT_SSLCERT, pathToCert);
    if (res != CURLE_OK)
        fprintf(stderr, "curl_easy_perform() failed: %s\n",
            curl_easy_strerror(res));
    curl_easy_setopt(curl, CURLOPT_SSLKEY, pathToKey);
}


int main(int argc, char **argv) {
    CURL *curl;
    CURLcode res;

    curl_global_init(CURL_GLOBAL_DEFAULT);

    curl = curl_easy_init();
    if (curl) {
        curl_easy_setopt(curl, CURLOPT_URL, "https://localhost:8443/RemSig/status");
        authenticate(curl);

#ifdef SKIP_PEER_VERIFICATION
        /*
         * If you want to connect to a site who isn't using a certificate that is
         * signed by one of the certs in the CA bundle you have, you can skip the
         * verification of the server's certificate. This makes the connection
         * A LOT LESS SECURE.
         *
         * If you have a CA cert for the server stored someplace else than in the
         * default bundle, then the CURLOPT_CAPATH option might come handy for
         * you.
         */
        curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
#endif

#ifdef SKIP_HOSTNAME_VERIFICATION
        /*
         * If the site you're connecting to uses a different host name that what
         * they have mentioned in their server certificate's commonName (or
         * subjectAltName) fields, libcurl will refuse to connect. You can skip
         * this check, but this will make the connection less secure.
         */
        curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
#endif

        /* Perform the request, res will get the return code */
        res = curl_easy_perform(curl);
        /* Check for errors */
        if (res != CURLE_OK)
            fprintf(stderr, "curl_easy_perform() failed: %s\n",
                curl_easy_strerror(res));

        /* always cleanup */
        curl_easy_cleanup(curl);
    }

    curl_global_cleanup();

    return 0;
}

Does someone know where could be problem? The server is running and can be accessed from different client and browser.

EDIT - SOLUTION

After adding curl_easy_setopt(curl, CURLOPT_VERBOSE, 1); to my code I find out that the problem was in certificate path. In path to certificate ./ should be added, otherwise libcurl can not find the certificate.

It should work, try this procedure: http://stackoverflow.com/questions/27611193/curl-ssl-with-self-signed-certificate/27611319#27611319 — Daniel Stenberg, May 06 '15 at 12:02
I tried it even though I don't really understand it but the openssl command was : socket: Connection refused connect:errno=111 — user3737648, May 06 '15 at 12:31
Okay I tried with the wrong port before it runs on 8443... now I have the server certificate in cacert.pem but I dont get the curl command — user3737648, May 06 '15 at 12:36
I tried the curl command Unable to communicate securely with peer: requested domain name does not match the server's certificate. is the response — user3737648, May 06 '15 at 12:43
This means your server's name is not included in its certificate: BAD SERVER. — Daniel Stenberg, May 06 '15 at 12:47
Yeah but when the verification of peer and host is disabled should not it work even with this problem? — user3737648, May 06 '15 at 12:51
You only mentioned CURLOPT_SSL_VERIFYPEER, not CURLOPT_SSL_VERIFYHOST - which is the one that checks the host name thing. — Daniel Stenberg, May 06 '15 at 13:05
I forgot to mentioned it, but it is in the code. Both verifications are disabled — user3737648, May 06 '15 at 14:15
Response from curl -k localhost:8443 was Empty reply from server — user3737648, May 06 '15 at 15:31

SSL Connect error with libcurl after SKIP_PEER_VERIFICATION?

0 Answers0