OpenSSL: openssl s_client verify return:1 but Verify return code: 0 (ok)

user_10918308 0
Viewed 2749

I am trying to establish connection to the server with self signed certificate. but during execution of

openssl s_client  -connect 127.0.0.1:21042 -CAfile ca.crt -cert client.crt -key client.key

I am getting verify return:1 but in the end i am getting Verify return code: 0 (ok)

depth=1 C = CH, ST = LU, L = Luzern, O = Ltd, CN = Stack Service, emailAddress = xyz@gmail.com
verify return:1
depth=0 C = CH, ST = LU, L = Luzern, O = Ltd, CN = Stack Service, emailAddress = xyz@gmail.com
verify return:1
---
Certificate chain
 0 s:C = CH, ST = LU, L = Luzern, O = Ltd, CN = Stack Service, emailAddress = xyz@gmail.com
   i:C = CH, ST = LU, L = Luzern, O = Ltd, CN = Stack Service, emailAddress = xyz@gmail.com
--- 
Acceptable client certificate CA names
C = CH, ST = LU, L = Luzern, O = Ltd, CN = Stack Service, emailAddress = xyz@gmail.com
Requested Signature Algorithms: ECDSA+SHA256:RSA-PSS+SHA256:RSA+SHA256:ECDSA+SHA384:RSA-PSS+SHA384:RSA+SHA384:RSA-PSS+SHA512:RSA+SHA512:RSA+SHA1
Shared Requested Signature Algorithms: ECDSA+SHA256:RSA-PSS+SHA256:RSA+SHA256:ECDSA+SHA384:RSA-PSS+SHA384:RSA+SHA384:RSA-PSS+SHA512:RSA+SHA512
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 1908 bytes and written 1994 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
read:errno=0

With this i am not able to connect to my server from my client application. What is the reason for getting verify return:1 in first and 2nd verification ?

openssl rsa ssl
1 Answers

A quick check against known good sites like google.com would show, that what you see is pretty normal. The initial verify return:1 are just the results from the verify callback for the specific certificate in the certificate chain. 1 means here success for this specific certificate and 0 means error, which then will cause abandoning the validation process and resulting in a final validation error.

The Verify return code: 0 (ok) instead is the result from the whole verification process. It is a code showing a validation error, where 0 is the numeric representation of X509_V_OK, i.e. no error. See verify for the different codes.

With this i am not able to connect to my server from my client application

Based on your output the TLS handshake is fine. So whatever problem you have is not in the TLS handshake or at least does not happen with openssl s_client.

user_30810180
Related