These contents were shown in callback when I try to use openssl_3.4.1 verify client certificate with rootCA int verify_callback(int preverify_ok, X509_STORE_CTX *ctx) { if (!preverify_ok) { int err = X509_STORE_CTX_get_error(ctx); printf("err: %d\n", err); printf("Certificate error [depth:%d]: %s\n", X509_STORE_CTX_get_error_depth(ctx), X509_verify_cert_error_string(err)); } return preverify_ok;// err: 26// Certificate error [depth:1]: unsuitable certificate purpose// DC540000:error:0A000086:SSL routines:tls_process_client_certificate:certificate verify failed:ssl\statem\statem_srvr.c:3724:}
When I check the client certificate,TLS Web Client Authentication was included in EKU. What problem with the client certificate or the rootCA? Please help me. Thank you very much! openssl x509 -in "C02_client_cert_CA1_CN.pem" -text -nooutCertificate: Data: Version: 3 (0x2) Serial Number: 68:de:c9:43:6c:ad:14:eb Signature Algorithm: sha256WithRSAEncryption Issuer: C=NL, ST=Netherlands, L=Arnhem, O=DNVGL, OU=INC, CN=C01_CA1_root_CA_CN Validity Not Before: Sep 9 03:34:00 2024 GMT Not After : Sep 9 03:34:00 2026 GMT Subject: C=NL, ST=Netherlands, L=Arnhem, O=DNVGL, OU=INC, CN=C02_client_cert_CA1_CN Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:d5:ff:a8:ee:c5:ca:2f:0a:16:57:05:93:f1:80: 58:6f:29:c2:71:c6:54:70:02:23:1e:c4:d4:08:bc: 8f:ad:0b:6f:43:a0:7c:9c:c9:2e:a4:0b:a3:d8:15: e7:81:ff:55:c9:02:a5:79:fa:ae:4b:5b:6d:2e:6a: b4:5e:6d:5a:12:ad:d3:78:7f:ee:e3:e1:cd:cc:58: 7d:32:f6:fe:20:da:2e:0c:9c:c4:b4:ff:a3:46:6c: 48:38:8b:27:cb:c7:88:c4:68:b2:dd:d2:65:cc:c0: 49:00:2c:65:e1:aa:6e:32:95:41:c1:e2:8b:75:6e: 6e:ea:4f:4a:26:1c:fc:0f:a0:3f:7d:46:f6:40:e7: fc:b3:5a:86:84:ba:0d:e7:1c:61:77:e3:e9:1a:17: fb:a2:3f:90:ae:52:6d:b2:8d:c0:16:a6:76:77:52: a1:cf:95:7a:b2:c8:78:95:85:6c:b9:a8:31:76:60: a8:06:fa:99:ea:d5:c9:75:ed:5e:bb:be:e9:e8:f2: 5e:53:f8:7b:54:43:06:f5:e4:77:5f:60:c8:7a:8e: b3:f3:bd:25:bf:45:a0:38:85:9e:bc:24:bd:22:c1: e2:ec:7d:ff:51:b0:bc:83:59:56:15:ad:83:35:c0: a4:c7:8c:74:e0:21:74:0e:47:79:3b:b0:a9:98:0e: 38:39 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: critical CA:FALSE X509v3 Subject Key Identifier: 3C:E9:6F:3F:26:E5:9A:6E:D1:A5:0A:3A:7A:35:A4:DC:8B:9C:FA:F6 X509v3 Authority Key Identifier: 39:6D:BC:62:73:32:A6:0C:13:C9:8E:A6:1F:D9:1A:A3:2A:EC:4A:7E X509v3 Key Usage: critical Digital Signature, Key Encipherment X509v3 Extended Key Usage: TLS Web Client Authentication Signature Algorithm: sha256WithRSAEncryption Signature Value: 6b:34:02:10:d1:73:54:ea:29:c5:35:58:d4:5a:c8:cb:09:e3: 37:58:6e:53:ce:8f:c2:af:e2:4f:42:a2:26:45:d0:ef:15:a1: 45:6f:fd:08:13:57:33:7e:e5:90:87:9d:bd:bd:f0:a0:04:b4: aa:0d:f0:35:97:78:25:6f:5b:02:a2:c1:d6:6d:93:00:18:c8: 56:3c:2a:94:c5:1b:a1:df:91:b1:d8:12:51:9b:e1:86:d1:19: 27:3f:8a:8d:2d:d5:af:29:31:51:96:2e:17:96:a8:02:a9:25: fd:56:c2:8a:2a:c3:eb:b1:90:a2:1f:cc:04:86:bb:0c:a2:f6: 32:6c:f7:0a:79:c0:22:64:6d:43:ee:fd:90:33:b0:8d:da:9f: 65:e8:18:cf:d1:61:f7:e7:73:69:e9:02:9d:f5:b2:8b:33:9c: ae:40:e9:5b:4b:23:8b:0a:72:f2:a4:48:40:9b:9e:83:20:3d: 73:ee:5e:b0:a8:43:c3:d3:9b:ee:21:f5:70:0d:b3:3d:2d:5e: 44:a6:4a:d1:ec:0e:8a:8c:57:45:e7:2d:a7:f1:1f:f4:1a:ad: 0b:3c:57:a7:40:b2:9d:b3:32:46:b0:cb:48:65:3b:5f:30:f4: 7b:0d:51:0c:53:7f:71:43:c6:49:31:c2:29:69:9d:4f:52:52: b0:a7:0b:5c
I try to use openssl s_client command and show me ''unsuitable certificate purpose'' openssl s_client -connect 127.0.0.1:19998 -cert "C02_client_cert_CA1_CN.pem" -key "C02_client_cert_CA1_CN_key.pem" -CAfile C01_CA1_root_CA_CN.pemConnecting to 127.0.0.1CONNECTED(00000190)Can't use SSL_get_servernamedepth=1 C=NL, ST=Netherlands, L=Arnhem, O=DNVGL, OU=INC, CN=C01_CA1_root_CA_CNverify error:num=26:unsuitable certificate purposeverify return:1depth=1 C=NL, ST=Netherlands, L=Arnhem, O=DNVGL, OU=INC, CN=C01_CA1_root_CA_CNverify return:1depth=0 C=NL, ST=Netherlands, L=Arnhem, O=DNVGL, OU=INC, CN=C02_server_cert_CA1_CNverify return:1E8210000:error:0A000413:SSL routines:ssl3_read_bytes:ssl/tls alert unsupported certificate:ssl\record\rec_layer_s3.c:908:SSL alert number 43---Certificate chain 0 s:C=NL, ST=Netherlands, L=Arnhem, O=DNVGL, OU=INC, CN=C02_server_cert_CA1_CN i:C=NL, ST=Netherlands, L=Arnhem, O=DNVGL, OU=INC, CN=C01_CA1_root_CA_CN a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256 v:NotBefore: Apr 8 12:22:00 2025 GMT; NotAfter: Apr 8 12:22:00 2026 GMT 1 s:C=NL, ST=Netherlands, L=Arnhem, O=DNVGL, OU=INC, CN=C01_CA1_root_CA_CN i:C=NL, ST=Netherlands, L=Arnhem, O=DNVGL, OU=INC, CN=C01_CA1_root_CA_CN a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256 v:NotBefore: Aug 25 09:25:00 2019 GMT; NotAfter: Aug 25 09:25:00 2029 GMT---Server certificate-----BEGIN CERTIFICATE-----MIID+zCCAuOgAwIBAgIITcgYOu0xWYgwDQYJKoZIhvcNAQELBQAwbzELMAkGA1UEBhMCTkwxFDASBgNVBAgTC05ldGhlcmxhbmRzMQ8wDQYDVQQHEwZBcm5oZW0xDjAMBgNVBAoTBUROVkdMMQwwCgYDVQQLEwNJTkMxGzAZBgNVBAMMEkMwMV9DQTFfcm9vdF9DQV9DTjAeFw0yNTA0MDgxMjIyMDBaFw0yNjA0MDgxMjIyMDBaMHMxCzAJBgNVBAYTAk5MMRQwEgYDVQQIEwtOZXRoZXJsYW5kczEPMA0GA1UEBxMGQXJuaGVtMQ4wDAYDVQQKEwVETlZHTDEMMAoGA1UECxMDSU5DMR8wHQYDVQQDDBZDMDJfc2VydmVyX2NlcnRfQ0ExX0NOMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArulRe8OaH3m/ZzK2CohJ01KsjVI4221xgGGTn/rzT6UD1ybL/F7t/0RYyy5uKHLm2IZr0TtrZujfB8qxsdnbE+JEU+nbbvfC9K9Ibux4ZyVa1PdnwZeUVQPBzYWhGq1Ln6AT17QHDtBzKBaXnkWfOxvo7egkkqT0rRWwb58Oo4kBZEZatnUwivpmMf//QrALeZuh8GBzIP0NpyipAYTsjkj+VW7o7XNMFL7LuvuwN/GWCqYxHCSg0mjahBtnwtla4DPq6UAEyaje3JNUd1NFL1rdLydTe9O7lzgUeATi1Uqu6OarUDndmxHPPmgTkMVUdZ02A9l9Fm8kGCV8oypMMQIDAQABo4GWMIGTMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFOGlVdlFbQZQDe5nXS3ei+K3CitsMB8GA1UdIwQYMBaAFDltvGJzMqYME8mOph/ZGqMq7Ep+MA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggrBgEFBQcDATAeBglghkgBhvhCAQ0EERYPeGNhIGNlcnRpZmljYXRlMA0GCSqGSIb3DQEBCwUAA4IBAQAjTorcSn/zsrJe0p+P8ZIPxL8KcMctb3ZfgNtU5FrgsVcLOhpsKd3SGE3Rq7b6WomKERMmisFDP+1ooGo6ULDKz8TVd/GlUBlqk4FWh59wCYL/XXcT/rw9A9B4zIjM1E7CnqwciS3JpCYBm0Gf9JPza0fFBUEzCG38rM9zkFQFDyRVBHxaoLsUVziZemgoryP/AYjpIhYdDFNmBdwIhuYb64yF1YqhgVOtklNDaNM4GeIKPcP+MuIeejYtXTvqlGGyhwZRxBPWHWy0yXnlwfGfuFT8/n3gQaiRaL+js/xuuXu8fVGCxG0QRBgNWG6XX3r2VzpbhS51rlUucaM7QWbD-----END CERTIFICATE-----subject=C=NL, ST=Netherlands, L=Arnhem, O=DNVGL, OU=INC, CN=C02_server_cert_CA1_CNissuer=C=NL, ST=Netherlands, L=Arnhem, O=DNVGL, OU=INC, CN=C01_CA1_root_CA_CN---No client certificate CA names sentClient Certificate Types: RSA sign, DSA sign, ECDSA signRequested Signature Algorithms: ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:ed25519:ed448:ecdsa_brainpoolP256r1_sha256:ecdsa_brainpoolP384r1_sha384:ecdsa_brainpoolP512r1_sha512:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:RSA+SHA224:DSA+SHA224:DSA+SHA256:DSA+SHA384:DSA+SHA512Shared Requested Signature Algorithms: ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:ed25519:ed448:ecdsa_brainpoolP256r1_sha256:ecdsa_brainpoolP384r1_sha384:ecdsa_brainpoolP512r1_sha512:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:RSA+SHA224:DSA+SHA224:DSA+SHA256:DSA+SHA384:DSA+SHA512---SSL handshake has read 2191 bytes and written 2877 bytesVerification error: unsuitable certificate purpose---New, TLSv1.2, Cipher is AES256-GCM-SHA384Protocol: TLSv1.2Server public key is 2048 bitSecure Renegotiation IS supportedCompression: NONEExpansion: NONENo ALPN negotiatedSSL-Session: Protocol : TLSv1.2 Cipher : AES256-GCM-SHA384 Session-ID: 51BDCF422E38FC8C40E441C4024FDCE767E28912890CFABC84A69B8E14C491B6 Session-ID-ctx: Master-Key: 47F445DA6F9753E347F80F18D7D9F1CAB920BF777A275F93E9294ACC6A190CF5AF76A35C74C02C26D236C9DC711E2E38 PSK identity: None PSK identity hint: None SRP username: None Start Time: 1752736498 Timeout : 7200 (sec) Verify return code: 26 (unsuitable certificate purpose) Extended master secret: yes---
openssl x509 -in C01_CA1_root_CA_CN.pem -text -nooutCertificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: sha256WithRSAEncryption Issuer: C=NL, ST=Netherlands, L=Arnhem, O=DNVGL, OU=INC, CN=C01_CA1_root_CA_CN Validity Not Before: Aug 25 09:25:00 2019 GMT Not After : Aug 25 09:25:00 2029 GMT Subject: C=NL, ST=Netherlands, L=Arnhem, O=DNVGL, OU=INC, CN=C01_CA1_root_CA_CN Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:c0:6a:00:89:e4:8d:88:90:a7:2f:37:c3:86:61: 5b:a0:4c:52:2a:68:63:21:7e:fe:76:36:a3:4a:ae: cd:f5:d6:42:e0:bd:9f:99:e2:fa:cf:ea:8d:99:7b: 28:79:da:dd:0b:85:94:a5:3d:48:4a:64:9d:4f:84: 95:8a:4d:67:b4:9c:29:c2:04:d6:79:3e:05:f9:e7: d7:c0:35:30:85:a9:69:79:90:4a:c5:97:6e:24:99: 4a:04:49:e6:11:2b:35:52:4d:65:c7:e2:65:d2:d3: 83:54:e1:ee:69:dd:77:7b:45:80:8a:1c:a0:81:4e: fd:fc:b3:66:4a:af:54:89:d3:1d:87:74:80:8e:04: 15:62:ed:d0:10:a5:05:ee:bf:da:a0:8f:df:12:1c: c1:91:16:a7:e8:5e:5f:ee:9b:60:b9:b2:36:af:1b: b8:85:6e:78:ae:21:0c:b8:e7:a1:56:d4:de:38:6a: 28:1c:1f:bd:15:3e:f7:ef:bd:a1:6a:0e:36:83:63: 2d:2a:5e:fd:cd:0e:e7:7c:3e:e3:1a:c1:35:90:09: eb:93:29:96:54:79:a3:82:5c:10:9f:dc:e7:cf:d1: 43:01:fd:25:dc:43:c0:d4:d1:6e:23:4e:91:8a:03: f7:f5:e5:63:ba:b7:ca:ae:31:1c:e5:20:c5:7e:2f: 4b:b1 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: critical CA:TRUE X509v3 Subject Key Identifier: 39:6D:BC:62:73:32:A6:0C:13:C9:8E:A6:1F:D9:1A:A3:2A:EC:4A:7E X509v3 Authority Key Identifier: 39:6D:BC:62:73:32:A6:0C:13:C9:8E:A6:1F:D9:1A:A3:2A:EC:4A:7E X509v3 Key Usage: critical Certificate Sign, CRL Sign X509v3 Extended Key Usage: OCSP Signing Signature Algorithm: sha256WithRSAEncryption Signature Value: 2e:9b:69:36:72:5d:d6:a3:af:e7:d1:4d:7a:28:97:e4:6f:61: d3:74:b9:59:fa:d4:26:fa:19:b8:0b:e6:61:0c:e7:11:e0:2d: 96:b7:3d:a8:e5:3b:91:df:6e:09:b1:39:55:39:06:28:8b:a1: 2f:d9:b7:66:8d:41:28:39:85:83:48:53:3f:7b:c7:da:0e:7b: 33:45:24:0a:65:70:4e:a1:da:08:14:9b:ab:64:eb:db:05:5b: 38:55:06:84:68:66:cd:c6:5f:c2:e8:9b:a6:4f:c2:7d:99:2b: f0:c4:4b:8f:dc:b3:db:49:60:31:64:d6:50:35:b5:86:1b:79: 9e:b8:5d:1a:f6:bb:69:cd:92:79:95:4c:37:68:0f:e4:b3:b3: 19:05:a9:f6:3f:47:8a:a8:f0:c4:51:a9:a6:4f:66:2f:9e:48: 75:f6:17:5d:7c:60:19:09:14:b4:60:ea:a9:75:8a:0b:2f:0a: d6:00:5d:88:bd:e4:b8:92:b7:32:80:0f:c0:32:c6:1b:39:a2: 43:cc:1f:a4:59:d0:07:ab:cb:be:65:2b:41:00:d6:7c:0c:99: d4:76:d6:66:6f:e8:e5:1b:8b:2c:f0:7d:8d:d2:d2:d6:49:bb: 3c:4a:f6:d2:9b:da:17:67:84:3a:0c:e5:1e:90:5e:8d:55:7b: ef:2c:bc:ba
|