1
votes

this is my first post on stackoverflow. Hopefully I am not disturbing anybody... :)
I've been working with gSOAP connecting to a http-webservice for my iPhone App for a while now. Now I am trying to swith to a https-webservice. I included openssl within the project and added the compileflat -DWITH_OPENSSL. Build&Run is working but unfortunatly openssl won't let me verify the webservers certificate.
Turning DEBUG-MODE on, I found that there is an issue with the webservers certificate:

SSL verify error or warning with certificate at depth 1: unable to get local issuer certificate certificate issuer /C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority certificate subject /O=VeriSign Trust Network/OU=VeriSign, Inc./OU=VeriSign International Server CA - Class 3/OU=www.verisign.com/CPS Incorp.by Ref. LIABILITY LTD.(c)97 VeriSign

Checking with SSL Shoppers SSL Checker results in:

The certificate should be trusted by all major web browsers (all the correct intermediate certificates are installed).

Any ideas on how to solve that issue?

BR

Martin

2

2 Answers

0
votes

well, sometimes RTFM really helps :)

Section 19.20 (Secure SOAP Clients with HTTPS/SSL) reads: "To disable server authentication for testing purposes, use the following:"

if (soap_ssl_client_context(&soap,
   SOAP_SSL_NO_AUTHENTICATION,
   NULL,
   NULL,
   NULL,
   NULL,
   NULL
   ))
{
   soap_print_fault(&soap, stderr);
   exit(1);
}

Unfortunatly, -DSOAP_DEBUG option still reads "SSL verify error or warning with certificate at depth 1: unable to get local issuer certificate". Anyway, it is working now.

0
votes

Disabling the Auth is not the right solution. I suspect you are not setting the ca certificates file path that openssl uses to trust CA's.

soap_ssl_client_context(&soapObject, SOAP_SSL_DEFAULT, NULL, NULL, cacerts.pem, NULL, NULL))

you can get cacerts.pem from mozilla. if your app only allows connecting to one website, then you should just leave the hash for the CA that website certificate is issued by and remove all the unneeded ca's from the pem file.