On Sep 4, 2012, at 4:18 AM, Michel Meyers wrote:
> Hello,
>
> It's been a long time since I have bugged this mailing list but sadly, I
> see no other way right now.
>
> I'm trying to set up TLS between an external FD on the Internet and an
> internal Director and SD, but failing.
>
> I have my own CA (created in TinyCA2 a long time ago) and have issued
> server type certificates to both the director/SD (both on same box) and
> the FD, but when I try to connect to the FD, I get this on the director
> console:
>
> 04-Sep 08:49 server-dir JobId 0: Error: openssl.c:86 Connect failure:
> ERR=error:14094413:SSL routines:SSL3_READ_BYTES:sslv3 alert unsupported
> certificate
> 04-Sep 08:49 server-dir JobId 0: Fatal error: TLS negotiation failed
> with FD at "fdbox.server.com:9102".
>
> When I try to use a client-type certificate on the FD side, I get this:
>
> 04-Sep 08:46 server-dir JobId 0: Error: tls.c:92 Error with certificate
> at depth: 0, issuer = /C=LU/L=MyCA/O=MyOrg/OU=MyOU/CN=Root
> CA/emailAddress=security@..., subject =
> /C=LU/L=MyCA/O=MyOrg/OU=MyOU/CN=fdbox.server.com, ERR=26:unsupported
> certificate purpose
> 04-Sep 08:46 server-dir JobId 0: Error: openssl.c:86 Connect failure:
> ERR=error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate
> verify failed
> 04-Sep 08:46 server-dir JobId 0: Fatal error: TLS negotiation failed
> with FD at "fdbox.server.com:9102".
>
> On the Client side, I get this with a server-cert:
>
> k233-fd: filed.c:276-0 filed: listening on port 9102
> k233-fd: cram-md5.c:72-0 send: auth cram-md5
> <233368770.2346346927@...> ssl=2
> k233-fd: cram-md5.c:150-0 sending resp to challenge: M7/byJ/nA+/av8JcPG+ZzB
> k233-fd: openssl.c:85-0 jcr=2480678 Connect failure:
> ERR=error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no
> certificate returned
>
> and with a Client-type cert:
> k233-fd: filed.c:276-0 filed: listening on port 9102
> k233-fd: cram-md5.c:72-0 send: auth cram-md5
> <233368770.2346346927@...> ssl=2
> k233-fd: cram-md5.c:150-0 sending resp to challenge: M7/byJ/nA+/av8JcPG+ZzB
> k233-fd: openssl.c:85-0 jcr=1fd6878 Connect failure:
> ERR=error:14094413:SSL routines:SSL3_READ_BYTES:sslv3 alert unsupported
> certificate
>
> The documentation doesn't really clarify which type of certificate goes
> where (TinyCA2 will only let me sign certs as Server or Client). Does
> the bacula-dir need a client-type cert?
>
> Has anybody got this working with Peer verification and their own CA?
> I'd be curious to see how you generated the certs…
I did not analyze what you did (sorry, no time), but I can point you at what I did for
my setup:
http://www.freebsddiary.org/bacula-tls.php
If memory servers, all certs were created the same way.
--
Dan Langille - http://langille.org
|