topic ACE SSL - bad certificate message in Application Networking

ACE SSL - bad certificate message

Martin Kyrc — Thu, 10 Jul 2008 12:49:39 GMT

hello guys,

I have basic www/https LB configuration on the ACE. in my lab was all working. now, in production, I have a problem with https connection. in sniffer output I can see after 3way handshake this:

SSLv3: Alert (Level: Fatal, description: Bad certificate)

what does it mean? I think, my SSL chain is correct (it's a certificate for the service and root certificate) - how can I verify certification chain? (analogous to CSM module).

thanks,

martin

Re: ACE SSL - bad certificate message

Roble Mumin — Fri, 11 Jul 2008 16:06:27 GMT

If i recall correct you verify a cert with...

crypto verify

in enable mode.

I don't have an ACE here right now so i can't check. But give it a try.

Roble

Re: ACE SSL - bad certificate message

Martin Kyrc — Mon, 14 Jul 2008 04:32:19 GMT

yes, with 'crypto verify ...' it's possible verify certificate and key pair. but how it's possible verify full certification chain (ca-root-cert, ca-cert, service-cert)?

the problem is solved - there was really bad certificate (but cert/key matched).

Re: ACE SSL - bad certificate message

ciscocsoc — Mon, 14 Jul 2008 07:37:07 GMT

Hi,

The openssl code has a verify function which will check a certificate against a chain. The chain needs to be a concatentation of pem format certificates and your certificate also needs to be in pem format. See http://www.openssl.org/docs/apps/verify.html

Example:

C:\ACE\WIP\Myfiles>c:\openssl\bin\openssl verify -CAfile chain.pem cert_12505775

75.pem

cert_1250577575.pem: OK

Openssl also provides for changing the format if necessary.

HTH

Cathy

Re: ACE SSL - bad certificate message

Martin Kyrc — Wed, 16 Jul 2008 08:15:31 GMT

yes, of course. openssl has this possibility, ACE hasn't (CSM has this possibility, maybe in new releases comes to ACE also).

thanks,

martin