rsyslog / rsyslog/librelp

TLS with client authentication does not send the list of acceptable issuers

Open
#265 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
32
Forks
39
Avg merge
2h 27m
Merged PRs (30d)
7

Description

No client certificate CA names are sent during the connection initialization.

Tested using: openssl s_client -connect server:port -prexit
Result: "No client certificate CA names sent"

Suggest using the CACert file CN(s) or other parameter with OpenSSL functions set_client_CA_list, add_client_CA, or similar to allow the client to select the correct certificate.

Thanks!

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the connection with openssl s_client -connect server:port -prexit and trace the TLS client-authentication initialization in the C/OpenSSL integration. Determine how the configured CA certificate information is passed to the server; done means the client receives a list of acceptable CA names during connection initialization.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
networking, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.