SSL: unable to obtain common name from peer certificate

3
votes

Sorry, My mistake, there's two things must be highlighted:

The CA cert Common Name must not same to the server/client side cert
The server/client side cert's common name must be same

I'm trying to using self-signed certificate for HTTPS Client side certificate. But, there's a problem " SSL: unable to obtain common name from peer certificate "

As you can see, the server side cert contains Common Name, why this problem occurs?

Here's curl output:

  • About to connect() to 127.0.0.1 port 443 (#0)
  • Trying 127.0.0.1... connected Enter PEM pass phrase:
  • successfully set certificate verify locations:
  • CAfile: /home/freeman/dev/git/ca_tools/ca_tools/ssl/CA/secure_ca.crt CApath: /etc/ssl/certs
  • SSLv3, TLS handshake, Client hello (1):
  • SSLv3, TLS handshake, Server hello (2):
  • SSLv3, TLS handshake, CERT (11):
  • SSLv3, TLS handshake, Server key exchange (12):
  • SSLv3, TLS handshake, Request CERT (13):
  • SSLv3, TLS handshake, Server finished (14):
  • SSLv3, TLS handshake, CERT (11):
  • SSLv3, TLS handshake, Client key exchange (16):
  • SSLv3, TLS handshake, CERT verify (15):
  • SSLv3, TLS change cipher, Client hello (1):
  • SSLv3, TLS handshake, Finished (20):
  • SSLv3, TLS change cipher, Client hello (1):
  • SSLv3, TLS handshake, Finished (20):
  • SSL connection using ECDHE-RSA-AES256-SHA
  • Server certificate:
  • subject: C=CN; ST=Beijing; L=Beijing; O=XiaoMi
  • start date: 2014-05-14 12:50:20 GMT
  • expire date: 2024-05-11 12:50:20 GMT
  • SSL: unable to obtain common name from peer certificate
  • Closing connection #0
  • SSLv3, TLS alert, Client hello (1):

Here's
#openssl x509 -in server.crt -text -noout

Certificate: Data: Version: 1 (0x0) Serial Number: 15298562268347408844 (0xd44f6953eb0aa1cc) Signature Algorithm: sha1WithRSAEncryption Issuer: C=CN, ST=Beijing, L=Beijing, O=OKK, OU=Test, CN=MyComp Validity :

3
curlsslhttps
Would you mind posting the commands you used to generate the CSR and the resulting certificate? (please do not post any key material) – Mark

3 Answers

5
votes

Try CURLOPT_SSL_VERIFYHOST=0 or curl -k

4
votes

Without knowing the data used to generate the CSR, it looks like the last component of your DN does not contain a CN attribute with the target host name. Typically SSL library clients will only check the first component for the CN attribute equal to the target host name. I would reverse the DN order and add a CN attribute with the host name.

If you provide more details on how you generated the CSR I would be happy to help you figure out how to fix it.

2
votes

The subject details from server cert from peer is :

subject: C=CN; ST=Beijing; L=Beijing; O=XiaoMi

The Issuer subject details is :

C=CN, ST=Beijing, L=Beijing, O=OKK, OU=Test, CN=MyComp Validity

Clearly the two are different (in case there was supposed to be any link attempted), since that is what I understood from the question.

In any case as seen in the curl error, the common-name attribute is missing. This could likely be due to that the certificate that was presented never contained it.

Suggest you try opening the certificate from a browser and verify.