| 1 | ----------------------------------------------------
|
|---|
| 2 | TESTING:
|
|---|
| 3 |
|
|---|
| 4 | The attached nginx configuration file is what I used for testing.
|
|---|
| 5 |
|
|---|
| 6 | Vincent Berant ( https://github.com/vincentbernat/rfc5077 ) has the client side
|
|---|
| 7 | testing tool for testing the impacts of session ids and session tickets using
|
|---|
| 8 | the openssl, gnutls and nss libraries.
|
|---|
| 9 |
|
|---|
| 10 | I have forked this tool and added options for delays, client side certificates
|
|---|
| 11 | and a few other things. https://github.com/grooverdan/rfc5077
|
|---|
| 12 |
|
|---|
| 13 | ENVIRONMENT:
|
|---|
| 14 |
|
|---|
| 15 | To setup the environment take a clone of my github rfc5077 tool.
|
|---|
| 16 |
|
|---|
| 17 | $ git clone https://github.com/grooverdan/rfc5077.git
|
|---|
| 18 |
|
|---|
| 19 | The dependencies are listed in the README.md so install those.
|
|---|
| 20 |
|
|---|
| 21 | Make the tools by running make.
|
|---|
| 22 |
|
|---|
| 23 | $ make
|
|---|
| 24 |
|
|---|
| 25 | If you do not have a configuration for client certificate testing run 'make certificate'
|
|---|
| 26 | Answer the following questions based on the output:
|
|---|
| 27 | Generating a self signed certificate...
|
|---|
| 28 | Please enter the details of the certificate's distinguished name. Just press enter to ignore a field.
|
|---|
| 29 | Country name (2 chars):
|
|---|
| 30 | Organization name:
|
|---|
| 31 | Organizational unit name:
|
|---|
| 32 | Locality name:
|
|---|
| 33 | State or province name:
|
|---|
| 34 | Common name: localhost
|
|---|
| 35 | UID:
|
|---|
| 36 | This field should not be used in new certificates.
|
|---|
| 37 | E-mail:
|
|---|
| 38 | Enter the certificate's serial number in decimal (default: 1348800523):
|
|---|
| 39 |
|
|---|
| 40 |
|
|---|
| 41 | Activation/Expiration time.
|
|---|
| 42 | The certificate will expire in (days): 6000
|
|---|
| 43 |
|
|---|
| 44 |
|
|---|
| 45 | Extensions.
|
|---|
| 46 | Does the certificate belong to an authority? (y/N): n
|
|---|
| 47 | Is this a TLS web client certificate? (y/N): y
|
|---|
| 48 | Will the certificate be used for IPsec IKE operations? (y/N): y
|
|---|
| 49 | Is this also a TLS web server certificate? (y/N): y
|
|---|
| 50 | Enter a dnsName of the subject of the certificate: localhost
|
|---|
| 51 | Enter a dnsName of the subject of the certificate:
|
|---|
| 52 | Enter the IP address of the subject of the certificate:
|
|---|
| 53 | Will the certificate be used for signing (DHE and RSA-EXPORT ciphersuites)? (y/N):
|
|---|
| 54 | Will the certificate be used for encryption (RSA ciphersuites)? (y/N):
|
|---|
| 55 | Enter the URI of the CRL distribution point:
|
|---|
| 56 | X.509 Certificate Information:
|
|---|
| 57 | ....
|
|---|
| 58 | Is the above information ok? (y/N): y
|
|---|
| 59 |
|
|---|
| 60 | Copy the certs to the nginx server configuration:
|
|---|
| 61 |
|
|---|
| 62 | $ cp cert.pem key.pem /usr/local/nginx/conf/
|
|---|
| 63 |
|
|---|
| 64 | For testing we are going to use the same certificates for client and server
|
|---|
| 65 | testing as this make the ssl verify of the nginx configuration easy.
|
|---|
| 66 |
|
|---|
| 67 | CONFIGURATION:
|
|---|
| 68 |
|
|---|
| 69 | $ cp nginx.conf /usr/local/nginx/conf
|
|---|
| 70 |
|
|---|
| 71 | $ patch -p1 < nginx-rfc5077.patch
|
|---|
| 72 |
|
|---|
| 73 | $ auto/configure --with-debug --with-http_ssl_module
|
|---|
| 74 |
|
|---|
| 75 | $ make && make install
|
|---|
| 76 |
|
|---|
| 77 | $ objs/nginx
|
|---|
| 78 |
|
|---|
| 79 | TEST OPERATION
|
|---|
| 80 |
|
|---|
| 81 | Tests use the tools of rfc5077. These are gnutls-client, openssl-client and nss-client.
|
|---|
| 82 | All these have the same syntax. The openssl-client one does however provide more ssl session
|
|---|
| 83 | information.
|
|---|
| 84 |
|
|---|
| 85 | For each of the below items openssl-client can be replaced with gnutls-client and
|
|---|
| 86 | nss-client.
|
|---|
| 87 |
|
|---|
| 88 | TEST 1: session IDs still work
|
|---|
| 89 |
|
|---|
| 90 | To do this we run the tools with tickets disabled.
|
|---|
| 91 |
|
|---|
| 92 | ./openssl-client -T -r localhost 4433
|
|---|
| 93 |
|
|---|
| 94 |
|
|---|
| 95 | Expected output - key bits marked with * at beginning of line.
|
|---|
| 96 |
|
|---|
| 97 | [✔] Parse arguments.
|
|---|
| 98 | [✔] Initialize OpenSSL library.
|
|---|
| 99 | [✔] Disable use of session tickets (RFC 5077).
|
|---|
| 100 | [✔] Solve localhost:4433:
|
|---|
| 101 | │ Will connect to 127.0.0.1
|
|---|
| 102 | [✔] Connect to localhost:4433.
|
|---|
| 103 | [✔] Start TLS renegotiation.
|
|---|
| 104 | [✔] Check if session was reused:
|
|---|
| 105 | * │ SSL session was not used
|
|---|
| 106 | [✔] Get current session:
|
|---|
| 107 | │ Session content:
|
|---|
| 108 | │ SSL-Session:
|
|---|
| 109 | │ Protocol : TLSv1
|
|---|
| 110 | │ Cipher : DHE-RSA-AES256-SHA
|
|---|
| 111 | * │ Session-ID: 0100A52103BD90A1FB8BBD561860CB5C140AE34F13794941FF1B2F637766BA07
|
|---|
| 112 | │ Session-ID-ctx:
|
|---|
| 113 | │ Master-Key: 7A01F4E88C56EDEDC191A62D254179D2FAB13067044DDBAC24CCEFB84AF20C67A609D472F90211FE0AE21B9ADC8688F0
|
|---|
| 114 | │ Key-Arg : None
|
|---|
| 115 | │ Krb5 Principal: None
|
|---|
| 116 | │ PSK identity: None
|
|---|
| 117 | │ PSK identity hint: None
|
|---|
| 118 | │ Start Time: 1348801331
|
|---|
| 119 | │ Timeout : 7200 (sec)
|
|---|
| 120 | │ Verify return code: 18 (self signed certificate)
|
|---|
| 121 | [✔] Send HTTP GET.
|
|---|
| 122 | [✔] Get HTTP answer:
|
|---|
| 123 | │ HTTP/1.1 200 OK
|
|---|
| 124 | [✔] End TLS connection.
|
|---|
| 125 | [✔] waiting 0 seconds.
|
|---|
| 126 | [✔] Connect to localhost:4433.
|
|---|
| 127 | [✔] Start TLS renegotiation.
|
|---|
| 128 | [✔] Check if session was reused:
|
|---|
| 129 | * │ SSL session correctly reused
|
|---|
| 130 | [✔] Get current session:
|
|---|
| 131 | │ Session content:
|
|---|
| 132 | │ SSL-Session:
|
|---|
| 133 | │ Protocol : TLSv1
|
|---|
| 134 | │ Cipher : DHE-RSA-AES256-SHA
|
|---|
| 135 | * │ Session-ID: 0100A52103BD90A1FB8BBD561860CB5C140AE34F13794941FF1B2F637766BA07
|
|---|
| 136 | │ Session-ID-ctx:
|
|---|
| 137 | │ Master-Key: 7A01F4E88C56EDEDC191A62D254179D2FAB13067044DDBAC24CCEFB84AF20C67A609D472F90211FE0AE21B9ADC8688F0
|
|---|
| 138 | │ Key-Arg : None
|
|---|
| 139 | │ Krb5 Principal: None
|
|---|
| 140 | │ PSK identity: None
|
|---|
| 141 | │ PSK identity hint: None
|
|---|
| 142 | │ Start Time: 1348801331
|
|---|
| 143 | │ Timeout : 7200 (sec)
|
|---|
| 144 | │ Verify return code: 18 (self signed certificate)
|
|---|
| 145 | [✔] Send HTTP GET.
|
|---|
| 146 | [✔] Get HTTP answer:
|
|---|
| 147 | │ HTTP/1.1 200 OK
|
|---|
| 148 | [✔] End TLS connection.
|
|---|
| 149 |
|
|---|
| 150 | Here were can see that the first connection didn't resume a session id.
|
|---|
| 151 | The second connection did resume a session id.
|
|---|
| 152 |
|
|---|
| 153 | The session-ID number is the same for both connections.
|
|---|
| 154 |
|
|---|
| 155 | TEST 2: operation on session tickets
|
|---|
| 156 |
|
|---|
| 157 | $ ./openssl-client -S -r localhost 4433
|
|---|
| 158 |
|
|---|
| 159 | Expected Output:
|
|---|
| 160 |
|
|---|
| 161 | [✔] Parse arguments.
|
|---|
| 162 | [✔] Initialize OpenSSL library.
|
|---|
| 163 | [✔] Solve localhost:4433:
|
|---|
| 164 | │ Will connect to 127.0.0.1
|
|---|
| 165 | [✔] Connect to localhost:4433.
|
|---|
| 166 | [✔] Start TLS renegotiation.
|
|---|
| 167 | [✔] Check if session was reused:
|
|---|
| 168 | │ SSL session was not used
|
|---|
| 169 | [✔] Get current session:
|
|---|
| 170 | │ Session content:
|
|---|
| 171 | │ SSL-Session:
|
|---|
| 172 | │ Protocol : TLSv1
|
|---|
| 173 | │ Cipher : DHE-RSA-AES256-SHA
|
|---|
| 174 | * │ Session-ID: CE9BF370F4865B6C3BD6EFC3A1F41DB223997FDA3F2E8F705433924F8FBBB350
|
|---|
| 175 | │ Session-ID-ctx:
|
|---|
| 176 | │ Master-Key: E867F33A87AFC90732D617484514CD1BCFB5B470FE4C27D1765F1B5C087AC20DDBFC5B17106449FE9DA4942FF7362FA3
|
|---|
| 177 | │ Key-Arg : None
|
|---|
| 178 | │ Krb5 Principal: None
|
|---|
| 179 | │ PSK identity: None
|
|---|
| 180 | │ PSK identity hint: None
|
|---|
| 181 | * │ TLS session ticket:
|
|---|
| 182 | * │ 0000 - 9a f4 23 9e 09 f4 c7 f5-9b 85 95 c0 09 df fb 38 ..#............8
|
|---|
| 183 | * │ 0010 - 67 94 74 68 19 34 f0 81-fc e6 85 79 0f 22 cd 6f g.th.4.....y.".o
|
|---|
| 184 | * │ 0020 - 1e b4 04 2d 96 8f bf 11-ff bd 61 67 da 00 79 29 ...-......ag..y)
|
|---|
| 185 | * │ 0030 - ff 1f ed a9 63 8b f8 f6-e3 e9 a1 70 67 c7 a4 6a ....c......pg..j
|
|---|
| 186 | * │ 0040 - ee d5 a8 c5 04 3e b1 1e-e8 06 30 cb 66 88 f1 4a .....>....0.f..J
|
|---|
| 187 | * │ 0050 - d6 19 97 0e 2e 1d 63 45-0b ff e0 21 d6 fb 6f 1c ......cE...!..o.
|
|---|
| 188 | * │ 0060 - 0c c5 db ee da f0 df d8-61 73 99 17 fd ea 6f 5c ........as....o\
|
|---|
| 189 | * │ 0070 - 72 00 12 8b 93 d7 94 c8-d2 01 f9 50 b9 43 17 e8 r..........P.C..
|
|---|
| 190 | * │ 0080 - 79 80 40 c2 ff be 7e 67-d1 4e d5 92 0f 8d f6 f8 y.@...~g.N......
|
|---|
| 191 | * │ 0090 - 0e f2 01 e0 00 6d b4 0e-4a 5a 16 54 d4 75 ef 51 .....m..JZ.T.u.Q
|
|---|
| 192 | │
|
|---|
| 193 | │ Start Time: 1348801578
|
|---|
| 194 | │ Timeout : 7200 (sec)
|
|---|
| 195 | │ Verify return code: 18 (self signed certificate)
|
|---|
| 196 | [✔] Send HTTP GET.
|
|---|
| 197 | [✔] Get HTTP answer:
|
|---|
| 198 | │ HTTP/1.1 200 OK
|
|---|
| 199 | [✔] End TLS connection.
|
|---|
| 200 | [✔] waiting 0 seconds.
|
|---|
| 201 | [✔] Connect to localhost:4433.
|
|---|
| 202 | [✔] Start TLS renegotiation.
|
|---|
| 203 | *[✔] Check if session was reused:
|
|---|
| 204 | * │ SSL session correctly reused
|
|---|
| 205 | [✔] Get current session:
|
|---|
| 206 | │ Session content:
|
|---|
| 207 | │ SSL-Session:
|
|---|
| 208 | │ Protocol : TLSv1
|
|---|
| 209 | │ Cipher : DHE-RSA-AES256-SHA
|
|---|
| 210 | * │ Session-ID: CE9BF370F4865B6C3BD6EFC3A1F41DB223997FDA3F2E8F705433924F8FBBB350
|
|---|
| 211 | │ Session-ID-ctx:
|
|---|
| 212 | │ Master-Key: E867F33A87AFC90732D617484514CD1BCFB5B470FE4C27D1765F1B5C087AC20DDBFC5B17106449FE9DA4942FF7362FA3
|
|---|
| 213 | │ Key-Arg : None
|
|---|
| 214 | │ Krb5 Principal: None
|
|---|
| 215 | │ PSK identity: None
|
|---|
| 216 | │ PSK identity hint: None
|
|---|
| 217 | │ TLS session ticket:
|
|---|
| 218 | * │ 0000 - 9a f4 23 9e 09 f4 c7 f5-9b 85 95 c0 09 df fb 38 ..#............8
|
|---|
| 219 | * │ 0010 - 67 94 74 68 19 34 f0 81-fc e6 85 79 0f 22 cd 6f g.th.4.....y.".o
|
|---|
| 220 | * │ 0020 - 1e b4 04 2d 96 8f bf 11-ff bd 61 67 da 00 79 29 ...-......ag..y)
|
|---|
| 221 | * │ 0030 - ff 1f ed a9 63 8b f8 f6-e3 e9 a1 70 67 c7 a4 6a ....c......pg..j
|
|---|
| 222 | * │ 0040 - ee d5 a8 c5 04 3e b1 1e-e8 06 30 cb 66 88 f1 4a .....>....0.f..J
|
|---|
| 223 | * │ 0050 - d6 19 97 0e 2e 1d 63 45-0b ff e0 21 d6 fb 6f 1c ......cE...!..o.
|
|---|
| 224 | * │ 0060 - 0c c5 db ee da f0 df d8-61 73 99 17 fd ea 6f 5c ........as....o\
|
|---|
| 225 | * │ 0070 - 72 00 12 8b 93 d7 94 c8-d2 01 f9 50 b9 43 17 e8 r..........P.C..
|
|---|
| 226 | * │ 0080 - 79 80 40 c2 ff be 7e 67-d1 4e d5 92 0f 8d f6 f8 y.@...~g.N......
|
|---|
| 227 | * │ 0090 - 0e f2 01 e0 00 6d b4 0e-4a 5a 16 54 d4 75 ef 51 .....m..JZ.T.u.Q
|
|---|
| 228 | │
|
|---|
| 229 | │ Start Time: 1348801578
|
|---|
| 230 | │ Timeout : 7200 (sec)
|
|---|
| 231 | │ Verify return code: 18 (self signed certificate)
|
|---|
| 232 | [✔] Send HTTP GET.
|
|---|
| 233 | [✔] Get HTTP answer:
|
|---|
| 234 | │ HTTP/1.1 200 OK
|
|---|
| 235 |
|
|---|
| 236 |
|
|---|
| 237 | Here we can ses that the session ticket is identical between two connections. Note only openssl-client
|
|---|
| 238 | displays the session ticket output. As per the RFC the session-id should be identical when using session
|
|---|
| 239 | tickets.
|
|---|
| 240 |
|
|---|
| 241 | TEST 3: Ensure that session tickets are used when both session id and session ticket are presented
|
|---|
| 242 |
|
|---|
| 243 | $ ./openssl-client -r localhost 4433
|
|---|
| 244 |
|
|---|
| 245 | Expected output:
|
|---|
| 246 |
|
|---|
| 247 | [✔] Parse arguments.
|
|---|
| 248 | [✔] Initialize OpenSSL library.
|
|---|
| 249 | [✔] Solve localhost:4433:
|
|---|
| 250 | │ Will connect to 127.0.0.1
|
|---|
| 251 | [✔] Connect to localhost:4433.
|
|---|
| 252 | [✔] Start TLS renegotiation.
|
|---|
| 253 | [✔] Check if session was reused:
|
|---|
| 254 | │ SSL session was not used
|
|---|
| 255 | [✔] Get current session:
|
|---|
| 256 | │ Session content:
|
|---|
| 257 | │ SSL-Session:
|
|---|
| 258 | │ Protocol : TLSv1
|
|---|
| 259 | │ Cipher : DHE-RSA-AES256-SHA
|
|---|
| 260 | │ Session-ID: B5FB477DC9EC2BF8DD889331A741B7C59459321B1FDD7806518E0E27A019D117
|
|---|
| 261 | │ Session-ID-ctx:
|
|---|
| 262 | │ Master-Key: 2D2BF38985D62EEE8A96E822E12141BE2BB1A5E54CF0B3AF79F112C5F523CD8705C8342197CA1F55DABCC92888928EC5
|
|---|
| 263 | │ Key-Arg : None
|
|---|
| 264 | │ Krb5 Principal: None
|
|---|
| 265 | │ PSK identity: None
|
|---|
| 266 | │ PSK identity hint: None
|
|---|
| 267 | * │ TLS session ticket:
|
|---|
| 268 | * │ 0000 - 37 20 ee b4 ae 62 b1 a7-22 e2 c5 d2 bc 69 21 66 7 ...b.."....i!f
|
|---|
| 269 | * │ 0010 - e5 8c 07 90 2c 98 15 7e-55 2e 13 86 5b 0f c6 be ....,..~U...[...
|
|---|
| 270 | * │ 0020 - 26 07 73 86 96 18 61 2a-dd 31 46 ce 9c 89 ea 53 &.s...a*.1F....S
|
|---|
| 271 | * │ 0030 - 5e 1a 74 16 f7 dd bc 3f-b0 7b 07 18 b9 fd 16 71 ^.t....?.{.....q
|
|---|
| 272 | * │ 0040 - 5a af cb ff c4 78 18 6f-48 f8 57 e6 76 9e 9a f1 Z....x.oH.W.v...
|
|---|
| 273 | * │ 0050 - 18 0d 93 e9 ef 32 66 29-96 7a 92 d9 f8 60 87 41 .....2f).z...`.A
|
|---|
| 274 | * │ 0060 - 70 e0 86 9a 96 cd a7 c1-27 97 98 56 27 11 9c f8 p.......'..V'...
|
|---|
| 275 | * │ 0070 - 3f 91 ca c5 2b 72 8e ea-46 47 46 23 32 ed eb b8 ?...+r..FGF#2...
|
|---|
| 276 | * │ 0080 - a1 d8 6c 34 da 90 9b d5-a0 1c df 92 86 b3 57 dc ..l4..........W.
|
|---|
| 277 | * │ 0090 - c1 fd 9c 3d e3 85 f4 96-88 ee 9e 3b 72 1b 77 0f ...=.......;r.w.
|
|---|
| 278 | │
|
|---|
| 279 | │ Start Time: 1348801913
|
|---|
| 280 | │ Timeout : 7200 (sec)
|
|---|
| 281 | │ Verify return code: 18 (self signed certificate)
|
|---|
| 282 | [✔] Send HTTP GET.
|
|---|
| 283 | [✔] Get HTTP answer:
|
|---|
| 284 | │ HTTP/1.1 200 OK
|
|---|
| 285 | [✔] End TLS connection.
|
|---|
| 286 | [✔] waiting 0 seconds.
|
|---|
| 287 | [✔] Connect to localhost:4433.
|
|---|
| 288 | [✔] Start TLS renegotiation.
|
|---|
| 289 | [✔] Check if session was reused:
|
|---|
| 290 | │ SSL session correctly reused
|
|---|
| 291 | [✔] Get current session:
|
|---|
| 292 | │ Session content:
|
|---|
| 293 | │ SSL-Session:
|
|---|
| 294 | │ Protocol : TLSv1
|
|---|
| 295 | │ Cipher : DHE-RSA-AES256-SHA
|
|---|
| 296 | │ Session-ID: B5FB477DC9EC2BF8DD889331A741B7C59459321B1FDD7806518E0E27A019D117
|
|---|
| 297 | │ Session-ID-ctx:
|
|---|
| 298 | │ Master-Key: 2D2BF38985D62EEE8A96E822E12141BE2BB1A5E54CF0B3AF79F112C5F523CD8705C8342197CA1F55DABCC92888928EC5
|
|---|
| 299 | │ Key-Arg : None
|
|---|
| 300 | │ Krb5 Principal: None
|
|---|
| 301 | │ PSK identity: None
|
|---|
| 302 | │ PSK identity hint: None
|
|---|
| 303 | * │ TLS session ticket:
|
|---|
| 304 | * │ 0000 - 37 20 ee b4 ae 62 b1 a7-22 e2 c5 d2 bc 69 21 66 7 ...b.."....i!f
|
|---|
| 305 | * │ 0010 - e5 8c 07 90 2c 98 15 7e-55 2e 13 86 5b 0f c6 be ....,..~U...[...
|
|---|
| 306 | * │ 0020 - 26 07 73 86 96 18 61 2a-dd 31 46 ce 9c 89 ea 53 &.s...a*.1F....S
|
|---|
| 307 | * │ 0030 - 5e 1a 74 16 f7 dd bc 3f-b0 7b 07 18 b9 fd 16 71 ^.t....?.{.....q
|
|---|
| 308 | * │ 0040 - 5a af cb ff c4 78 18 6f-48 f8 57 e6 76 9e 9a f1 Z....x.oH.W.v...
|
|---|
| 309 | * │ 0050 - 18 0d 93 e9 ef 32 66 29-96 7a 92 d9 f8 60 87 41 .....2f).z...`.A
|
|---|
| 310 | * │ 0060 - 70 e0 86 9a 96 cd a7 c1-27 97 98 56 27 11 9c f8 p.......'..V'...
|
|---|
| 311 | * │ 0070 - 3f 91 ca c5 2b 72 8e ea-46 47 46 23 32 ed eb b8 ?...+r..FGF#2...
|
|---|
| 312 | * │ 0080 - a1 d8 6c 34 da 90 9b d5-a0 1c df 92 86 b3 57 dc ..l4..........W.
|
|---|
| 313 | * │ 0090 - c1 fd 9c 3d e3 85 f4 96-88 ee 9e 3b 72 1b 77 0f ...=.......;r.w.
|
|---|
| 314 | │
|
|---|
| 315 | │ Start Time: 1348801913
|
|---|
| 316 | │ Timeout : 7200 (sec)
|
|---|
| 317 | │ Verify return code: 18 (self signed certificate)
|
|---|
| 318 | [✔] Send HTTP GET.
|
|---|
| 319 | [✔] Get HTTP answer:
|
|---|
| 320 | │ HTTP/1.1 200 OK
|
|---|
| 321 | [✔] End TLS connection.
|
|---|
| 322 |
|
|---|
| 323 |
|
|---|
| 324 | As above we can see the session ticket is identical.
|
|---|
| 325 |
|
|---|
| 326 | TEST 4: ensure that the session tickets timeout
|
|---|
| 327 |
|
|---|
| 328 | The configuration has a 10 second timeout. Here we run the client with 15 seconds between
|
|---|
| 329 | reconnections:
|
|---|
| 330 |
|
|---|
| 331 | $ ./openssl-client -r -d 15 localhost 4433
|
|---|
| 332 |
|
|---|
| 333 | Expected output:
|
|---|
| 334 |
|
|---|
| 335 | [✔] Parse arguments.
|
|---|
| 336 | [✔] Initialize OpenSSL library.
|
|---|
| 337 | [✔] Solve localhost:4433:
|
|---|
| 338 | │ Will connect to 127.0.0.1
|
|---|
| 339 | [✔] Connect to localhost:4433.
|
|---|
| 340 | [✔] Start TLS renegotiation.
|
|---|
| 341 | [✔] Check if session was reused:
|
|---|
| 342 | │ SSL session was not used
|
|---|
| 343 | [✔] Get current session:
|
|---|
| 344 | │ Session content:
|
|---|
| 345 | │ SSL-Session:
|
|---|
| 346 | │ Protocol : TLSv1
|
|---|
| 347 | │ Cipher : DHE-RSA-AES256-SHA
|
|---|
| 348 | │ Session-ID: F812EC4DEFA21936D5578D55646ED7DA81C3096070A653142217E4D727B4DEC7
|
|---|
| 349 | │ Session-ID-ctx:
|
|---|
| 350 | │ Master-Key: 32BA72DBE79A4FCC429B61F646970049E7E2BAC86770500D4AF8767803667D73C8E8C5DBD1C465131550420F587C7183
|
|---|
| 351 | │ Key-Arg : None
|
|---|
| 352 | │ Krb5 Principal: None
|
|---|
| 353 | │ PSK identity: None
|
|---|
| 354 | │ PSK identity hint: None
|
|---|
| 355 | * │ TLS session ticket:
|
|---|
| 356 | * │ 0000 - c5 c9 7d 85 16 41 e4 5b-cc 5f 6a 4e fe a5 bf 9f ..}..A.[._jN....
|
|---|
| 357 | * │ 0010 - 9c 07 f2 4f d5 af 8f 42-76 2f 8e f5 b1 55 84 86 ...O...Bv/...U..
|
|---|
| 358 | * │ 0020 - f1 27 11 55 cf e9 a4 bd-82 b0 47 89 d7 01 75 b9 .'.U......G...u.
|
|---|
| 359 | * │ 0030 - e3 99 94 89 f1 bd 49 17-30 2c 67 5c 02 85 47 ed ......I.0,g\..G.
|
|---|
| 360 | * │ 0040 - e3 ea f3 2a 08 a8 68 f1-ca eb ac 59 56 45 b7 51 ...*..h....YVE.Q
|
|---|
| 361 | * │ 0050 - e0 9a 3b 29 9b 85 f0 8a-10 bd 84 3c af 84 d2 70 ..;).......<...p
|
|---|
| 362 | * │ 0060 - 54 16 8a 36 65 98 c7 a4-b9 a6 f0 38 fe e6 83 c9 T..6e......8....
|
|---|
| 363 | * │ 0070 - 7b b3 41 e9 ba 03 62 21-cd f3 fb d7 36 75 30 b1 {.A...b!....6u0.
|
|---|
| 364 | * │ 0080 - 30 42 d0 80 d2 ac 9e 36-e5 9e 91 df e2 91 d1 b2 0B.....6........
|
|---|
| 365 | * │ 0090 - 20 06 0d bf d3 41 33 75-05 67 b7 b8 e6 b0 0c 57 ....A3u.g.....W
|
|---|
| 366 | │
|
|---|
| 367 | │ Start Time: 1348802062
|
|---|
| 368 | │ Timeout : 7200 (sec)
|
|---|
| 369 | │ Verify return code: 18 (self signed certificate)
|
|---|
| 370 | [✔] Send HTTP GET.
|
|---|
| 371 | [✔] Get HTTP answer:
|
|---|
| 372 | │ HTTP/1.1 200 OK
|
|---|
| 373 | [✔] End TLS connection.
|
|---|
| 374 | [✔] waiting 15 seconds.
|
|---|
| 375 | [✔] Connect to localhost:4433.
|
|---|
| 376 | [✔] Start TLS renegotiation.
|
|---|
| 377 | *[‼] Check if session was reused:
|
|---|
| 378 | * │ No session was reused.
|
|---|
| 379 | [✔] Get current session:
|
|---|
| 380 | │ Session content:
|
|---|
| 381 | │ SSL-Session:
|
|---|
| 382 | │ Protocol : TLSv1
|
|---|
| 383 | │ Cipher : DHE-RSA-AES256-SHA
|
|---|
| 384 | │ Session-ID: 6B8C59C43F82A7E68B59772C7E219C1A147BD811AFEA1C06D2B299AEDCE54E13
|
|---|
| 385 | │ Session-ID-ctx:
|
|---|
| 386 | │ Master-Key: 3CD7B96D73240062DEC972C2C85A56AFA393F8AE2FE43E20D666C9201176250333C0C1EBC5A20ADB260C48102D8703E2
|
|---|
| 387 | │ Key-Arg : None
|
|---|
| 388 | │ Krb5 Principal: None
|
|---|
| 389 | │ PSK identity: None
|
|---|
| 390 | │ PSK identity hint: None
|
|---|
| 391 | * │ TLS session ticket:
|
|---|
| 392 | * │ 0000 - 06 94 4c bf 32 22 98 df-85 6a a7 a7 59 dc e5 63 ..L.2"...j..Y..c
|
|---|
| 393 | * │ 0010 - 2c 40 ca ca 47 46 74 1a-40 69 ed ef 94 f2 36 9a ,@..GFt.@i....6.
|
|---|
| 394 | * │ 0020 - e6 e9 d3 7c 72 ff eb 09-0b fc 6d 90 43 f5 11 db ...|r.....m.C...
|
|---|
| 395 | * │ 0030 - 0e 94 10 72 ce 99 23 d4-cd 2d 2c e7 c7 85 53 59 ...r..#..-,...SY
|
|---|
| 396 | * │ 0040 - 0f 73 25 91 f1 40 f5 c8-62 6c b5 9c 80 2e a4 69 .s%..@..bl.....i
|
|---|
| 397 | * │ 0050 - 29 89 1c ee 6b 75 73 f4-c8 9a d8 d0 c8 20 b2 58 )...kus...... .X
|
|---|
| 398 | * │ 0060 - a0 5b 04 2f 7e 08 9e c6-be 53 95 9f 20 d0 a4 ca .[./~....S.. ...
|
|---|
| 399 | * │ 0070 - 36 df 50 32 76 d8 0e d9-d6 2b 8e b3 32 fc 45 97 6.P2v....+..2.E.
|
|---|
| 400 | * │ 0080 - 21 6d db f9 16 45 76 8d-90 e3 5c 08 6c a0 c9 47 !m...Ev...\.l..G
|
|---|
| 401 | * │ 0090 - 7d 69 0a 7a ff c8 f7 11-e0 b9 91 2a 3c db 80 2f }i.z.......*<../
|
|---|
| 402 | │
|
|---|
| 403 | │ Start Time: 1348802077
|
|---|
| 404 | │ Timeout : 7200 (sec)
|
|---|
| 405 | │ Verify return code: 18 (self signed certificate)
|
|---|
| 406 | [✔] Send HTTP GET.
|
|---|
| 407 | [✔] Get HTTP answer:
|
|---|
| 408 | │ HTTP/1.1 200 OK
|
|---|
| 409 | [✔] End TLS connection.
|
|---|
| 410 |
|
|---|
| 411 | Here we see that there was no session resumption and the session tickets are different.
|
|---|
| 412 |
|
|---|
| 413 | TEST 5: Session ticket renewing.
|
|---|
| 414 |
|
|---|
| 415 | With a timeout set for 10 seconds the renew time is 5 seconds. Here we perform a number
|
|---|
| 416 | of reconnections 4 seconds apart.
|
|---|
| 417 |
|
|---|
| 418 | Wait 10 seconds from last test to ensure that the session ticket cache has expired.
|
|---|
| 419 |
|
|---|
| 420 | $ ./openssl-client -r -r -r -d 4 localhost 4433
|
|---|
| 421 |
|
|---|
| 422 | (almost) Expected output:
|
|---|
| 423 |
|
|---|
| 424 | [✔] Parse arguments.
|
|---|
| 425 | [✔] Initialize OpenSSL library.
|
|---|
| 426 | [✔] Solve localhost:4433:
|
|---|
| 427 | │ Will connect to 127.0.0.1
|
|---|
| 428 | [✔] Connect to localhost:4433.
|
|---|
| 429 | [✔] Start TLS renegotiation.
|
|---|
| 430 | [✔] Check if session was reused:
|
|---|
| 431 | │ SSL session was not used
|
|---|
| 432 | [✔] Get current session:
|
|---|
| 433 | │ Session content:
|
|---|
| 434 | │ SSL-Session:
|
|---|
| 435 | │ Protocol : TLSv1
|
|---|
| 436 | │ Cipher : DHE-RSA-AES256-SHA
|
|---|
| 437 | │ Session-ID: B1C4C69EA2AF8B6A20829B8DEDC8F7538470C3349F730E617A42FA1D1FAA0C62
|
|---|
| 438 | │ Session-ID-ctx:
|
|---|
| 439 | │ Master-Key: 2AB6444DC0C983293CCAA41A76943D329B05AEC6597230C239D2FA5552AD25D4448DB014D28C8BF68F8A49198D3CE26D
|
|---|
| 440 | │ Key-Arg : None
|
|---|
| 441 | │ Krb5 Principal: None
|
|---|
| 442 | │ PSK identity: None
|
|---|
| 443 | │ PSK identity hint: None
|
|---|
| 444 | * │ TLS session ticket:
|
|---|
| 445 | * │ 0000 - 8c f0 b6 e1 a1 50 8f 88-a0 9d 2a 91 0d 6b d6 65 .....P....*..k.e
|
|---|
| 446 | * │ 0010 - 70 74 24 ec 6f 83 5c ee-80 cf be 8c d8 e1 65 84 pt$.o.\.......e.
|
|---|
| 447 | * │ 0020 - 80 a1 e2 26 1b c9 5b 23-b8 5a 9a 0e 33 cf 62 4d ...&..[#.Z..3.bM
|
|---|
| 448 | * │ 0030 - 93 1f b1 42 aa 13 d4 20-b9 22 81 ee f4 2d 38 d7 ...B... ."...-8.
|
|---|
| 449 | * │ 0040 - e3 18 cf a9 c3 fb 81 8d-1f f9 93 bf 08 7a c1 16 .............z..
|
|---|
| 450 | * │ 0050 - a0 98 16 0a bf dc df cd-82 f9 b0 1c f2 94 1d 67 ...............g
|
|---|
| 451 | * │ 0060 - 49 59 a1 df ff 4d 51 c5-72 34 64 08 8f 96 c9 c7 IY...MQ.r4d.....
|
|---|
| 452 | * │ 0070 - aa 02 2b 03 91 b2 6f e8-dc 8d 79 34 88 f7 6f 51 ..+...o...y4..oQ
|
|---|
| 453 | * │ 0080 - 77 92 82 ac e7 ef 48 3f-28 9a a4 7d be 9e 7d 63 w.....H?(..}..}c
|
|---|
| 454 | * │ 0090 - f5 03 cc a5 7f ee d8 bc-93 54 7f 67 90 ef 64 df .........T.g..d.
|
|---|
| 455 | │
|
|---|
| 456 | │ Start Time: 1348909837
|
|---|
| 457 | │ Timeout : 7200 (sec)
|
|---|
| 458 | │ Verify return code: 18 (self signed certificate)
|
|---|
| 459 | [✔] Send HTTP GET.
|
|---|
| 460 | [✔] Get HTTP answer:
|
|---|
| 461 | │ HTTP/1.1 200 OK
|
|---|
| 462 | [✔] End TLS connection.
|
|---|
| 463 | [✔] waiting 4 seconds.
|
|---|
| 464 | [✔] Connect to localhost:4433.
|
|---|
| 465 | [✔] Start TLS renegotiation.
|
|---|
| 466 | [✔] Check if session was reused:
|
|---|
| 467 | │ SSL session correctly reused
|
|---|
| 468 | [✔] Get current session:
|
|---|
| 469 | │ Session content:
|
|---|
| 470 | │ SSL-Session:
|
|---|
| 471 | │ Protocol : TLSv1
|
|---|
| 472 | │ Cipher : DHE-RSA-AES256-SHA
|
|---|
| 473 | │ Session-ID: B1C4C69EA2AF8B6A20829B8DEDC8F7538470C3349F730E617A42FA1D1FAA0C62
|
|---|
| 474 | │ Session-ID-ctx:
|
|---|
| 475 | │ Master-Key: 2AB6444DC0C983293CCAA41A76943D329B05AEC6597230C239D2FA5552AD25D4448DB014D28C8BF68F8A49198D3CE26D
|
|---|
| 476 | │ Key-Arg : None
|
|---|
| 477 | │ Krb5 Principal: None
|
|---|
| 478 | │ PSK identity: None
|
|---|
| 479 | │ PSK identity hint: None
|
|---|
| 480 | * │ TLS session ticket:
|
|---|
| 481 | * │ 0000 - 8c f0 b6 e1 a1 50 8f 88-a0 9d 2a 91 0d 6b d6 65 .....P....*..k.e
|
|---|
| 482 | * │ 0010 - 70 74 24 ec 6f 83 5c ee-80 cf be 8c d8 e1 65 84 pt$.o.\.......e.
|
|---|
| 483 | * │ 0020 - 80 a1 e2 26 1b c9 5b 23-b8 5a 9a 0e 33 cf 62 4d ...&..[#.Z..3.bM
|
|---|
| 484 | * │ 0030 - 93 1f b1 42 aa 13 d4 20-b9 22 81 ee f4 2d 38 d7 ...B... ."...-8.
|
|---|
| 485 | * │ 0040 - e3 18 cf a9 c3 fb 81 8d-1f f9 93 bf 08 7a c1 16 .............z..
|
|---|
| 486 | * │ 0050 - a0 98 16 0a bf dc df cd-82 f9 b0 1c f2 94 1d 67 ...............g
|
|---|
| 487 | * │ 0060 - 49 59 a1 df ff 4d 51 c5-72 34 64 08 8f 96 c9 c7 IY...MQ.r4d.....
|
|---|
| 488 | * │ 0070 - aa 02 2b 03 91 b2 6f e8-dc 8d 79 34 88 f7 6f 51 ..+...o...y4..oQ
|
|---|
| 489 | * │ 0080 - 77 92 82 ac e7 ef 48 3f-28 9a a4 7d be 9e 7d 63 w.....H?(..}..}c
|
|---|
| 490 | * │ 0090 - f5 03 cc a5 7f ee d8 bc-93 54 7f 67 90 ef 64 df .........T.g..d.
|
|---|
| 491 | │
|
|---|
| 492 | │ Start Time: 1348909837
|
|---|
| 493 | │ Timeout : 7200 (sec)
|
|---|
| 494 | │ Verify return code: 18 (self signed certificate)
|
|---|
| 495 | [✔] Send HTTP GET.
|
|---|
| 496 | [✔] Get HTTP answer:
|
|---|
| 497 | │ HTTP/1.1 200 OK
|
|---|
| 498 | [✔] End TLS connection.
|
|---|
| 499 | [✔] waiting 4 seconds.
|
|---|
| 500 | [✔] Connect to localhost:4433.
|
|---|
| 501 | [✔] Start TLS renegotiation.
|
|---|
| 502 | [✔] Check if session was reused:
|
|---|
| 503 | │ SSL session correctly reused
|
|---|
| 504 | [✔] Get current session:
|
|---|
| 505 | │ Session content:
|
|---|
| 506 | │ SSL-Session:
|
|---|
| 507 | │ Protocol : TLSv1
|
|---|
| 508 | │ Cipher : DHE-RSA-AES256-SHA
|
|---|
| 509 | │ Session-ID: B1C4C69EA2AF8B6A20829B8DEDC8F7538470C3349F730E617A42FA1D1FAA0C62
|
|---|
| 510 | │ Session-ID-ctx:
|
|---|
| 511 | │ Master-Key: 2AB6444DC0C983293CCAA41A76943D329B05AEC6597230C239D2FA5552AD25D4448DB014D28C8BF68F8A49198D3CE26D
|
|---|
| 512 | │ Key-Arg : None
|
|---|
| 513 | │ Krb5 Principal: None
|
|---|
| 514 | │ PSK identity: None
|
|---|
| 515 | │ PSK identity hint: None
|
|---|
| 516 | * │ TLS session ticket:
|
|---|
| 517 | * │ 0000 - 8c f0 b6 e1 a1 50 8f 88-a0 9d 2a 91 0d 6b d6 65 .....P....*..k.e
|
|---|
| 518 | * │ 0010 - 70 74 24 ec 6f 83 5c ee-80 cf be 8c d8 e1 65 84 pt$.o.\.......e.
|
|---|
| 519 | * │ 0020 - 80 a1 e2 26 1b c9 5b 23-b8 5a 9a 0e 33 cf 62 4d ...&..[#.Z..3.bM
|
|---|
| 520 | * │ 0030 - 93 1f b1 42 aa 13 d4 20-b9 22 81 ee f4 2d 38 d7 ...B... ."...-8.
|
|---|
| 521 | * │ 0040 - e3 18 cf a9 c3 fb 81 8d-1f f9 93 bf 08 7a c1 16 .............z..
|
|---|
| 522 | * │ 0050 - a0 98 16 0a bf dc df cd-82 f9 b0 1c f2 94 1d 67 ...............g
|
|---|
| 523 | * │ 0060 - 49 59 a1 df ff 4d 51 c5-72 34 64 08 8f 96 c9 c7 IY...MQ.r4d.....
|
|---|
| 524 | * │ 0070 - aa 02 2b 03 91 b2 6f e8-dc 8d 79 34 88 f7 6f 51 ..+...o...y4..oQ
|
|---|
| 525 | * │ 0080 - 77 92 82 ac e7 ef 48 3f-28 9a a4 7d be 9e 7d 63 w.....H?(..}..}c
|
|---|
| 526 | * │ 0090 - f5 03 cc a5 7f ee d8 bc-93 54 7f 67 90 ef 64 df .........T.g..d.
|
|---|
| 527 | │
|
|---|
| 528 | │ Start Time: 1348909837
|
|---|
| 529 | │ Timeout : 7200 (sec)
|
|---|
| 530 | │ Verify return code: 18 (self signed certificate)
|
|---|
| 531 | [✔] Send HTTP GET.
|
|---|
| 532 | [✔] Get HTTP answer:
|
|---|
| 533 | │ HTTP/1.1 200 OK
|
|---|
| 534 | [✔] End TLS connection.
|
|---|
| 535 | [✔] waiting 4 seconds.
|
|---|
| 536 | [✔] Connect to localhost:4433.
|
|---|
| 537 | *[✘] Start TLS renegotiation:
|
|---|
| 538 | * │ Unable to start TLS renegotiation:
|
|---|
| 539 | * │ error:1408E0F4:SSL routines:SSL3_GET_MESSAGE:unexpected message
|
|---|
| 540 |
|
|---|
| 541 | The first three session tickets are identical which is what's expected.
|
|---|
| 542 |
|
|---|
| 543 | The last connection should of reconnected but had a different TLS session ticket.
|
|---|
| 544 |
|
|---|
| 545 | TEST 6: Client certificate support
|
|---|
| 546 |
|
|---|
| 547 | Here we use the cert.pem and key.pem generated earlier.
|
|---|
| 548 |
|
|---|
| 549 | $ ./openssl-client -r -S -C cert.pem -K key.pem localhost 4433
|
|---|
| 550 |
|
|---|
| 551 | Expected Output:
|
|---|
| 552 |
|
|---|
| 553 | [✔] Parse arguments.
|
|---|
| 554 | [✔] Initialize OpenSSL library.
|
|---|
| 555 | [✔] Solve localhost:4433:
|
|---|
| 556 | │ Will connect to 127.0.0.1
|
|---|
| 557 | [✔] Connect to localhost:4433.
|
|---|
| 558 | [✔] Start TLS renegotiation.
|
|---|
| 559 | [✔] Check if session was reused:
|
|---|
| 560 | │ SSL session was not used
|
|---|
| 561 | [✔] Get current session:
|
|---|
| 562 | │ Session content:
|
|---|
| 563 | │ SSL-Session:
|
|---|
| 564 | │ Protocol : TLSv1
|
|---|
| 565 | │ Cipher : DHE-RSA-AES256-SHA
|
|---|
| 566 | │ Session-ID: 126A1CC3AC0E73853391E612FD8992DE502A91CEA6F7DB7572882DF4EFF0C496
|
|---|
| 567 | │ Session-ID-ctx:
|
|---|
| 568 | │ Master-Key: E89B9E260BDF67BFEFD4FAE1ED056F4D1BF3FDFD09C50A091A7292756C65430C10C7F131F4C4C557C3A836EC02C3109F
|
|---|
| 569 | │ Key-Arg : None
|
|---|
| 570 | │ Krb5 Principal: None
|
|---|
| 571 | │ PSK identity: None
|
|---|
| 572 | │ PSK identity hint: None
|
|---|
| 573 | * │ TLS session ticket:
|
|---|
| 574 | * │ 0000 - 0b 0b 2d b4 92 c1 b3 ba-fe 01 6f f6 1c 35 0e 3f ..-.......o..5.?
|
|---|
| 575 | * │ 0010 - d9 e5 e8 dd ed 9a f7 82-83 2f 01 4f 88 70 5e 73 ........./.O.p^s
|
|---|
| 576 | * │ 0020 - 88 b0 c8 eb dc 18 2c d3-0f ef 6d dd 6e ce 9e f3 ......,...m.n...
|
|---|
| 577 | * │ 0030 - 85 15 e9 f5 bf 21 38 c0-f6 ce d0 e8 f5 6c 37 54 .....!8......l7T
|
|---|
| 578 | * │ 0040 - 42 46 0f 71 59 c5 45 62-41 20 e6 cc 6a 1f 16 a0 BF.qY.EbA ..j...
|
|---|
| 579 | * │ 0050 - a0 a8 fc 21 21 f6 20 ff-a1 41 3f 6b 08 f4 1b bc ...!!. ..A?k....
|
|---|
| 580 | * │ 0060 - c2 19 a1 d5 ae 97 79 7f-0c 4c 93 81 22 1c e1 f1 ......y..L.."...
|
|---|
| 581 | * │ 0070 - d0 76 d9 13 e7 e1 7e 15-b2 31 ff 5a 2c 1f a0 b4 .v....~..1.Z,...
|
|---|
| 582 | * │ 0080 - e8 88 24 13 66 45 34 e4-65 c7 e9 12 57 75 bb 42 ..$.fE4.e...Wu.B
|
|---|
| 583 | * │ 0090 - c8 b3 82 cf 0e 98 05 de-27 5e c5 e4 a5 c9 fd b0 ........'^......
|
|---|
| 584 | * │ 00a0 - 40 75 d8 ae 22 39 b1 78-79 5f 7c aa 31 fd bd fa @u.."9.xy_|.1...
|
|---|
| 585 | * │ 00b0 - 2f 66 96 56 2c 4f aa 7e-29 d6 3a 58 ec f1 2b 51 /f.V,O.~).:X..+Q
|
|---|
| 586 | * │ 00c0 - e6 84 25 31 d3 36 92 c5-0d f7 77 56 06 86 ed 24 ..%1.6....wV...$
|
|---|
| 587 | * │ 00d0 - b3 46 93 69 82 c6 c8 a7-5d 7d 90 d3 fc 7b ca 0b .F.i....]}...{..
|
|---|
| 588 | * │ 00e0 - ce 8d f2 be 83 70 21 eb-ae 41 f0 63 49 a8 d9 b0 .....p!..A.cI...
|
|---|
| 589 | * │ 00f0 - bc d1 8b b0 9d 4f ca 94-d5 0c 38 f7 b0 58 c2 0c .....O....8..X..
|
|---|
| 590 | * │ 0100 - 55 dd b8 2a 26 7f bf ff-d1 c5 26 19 96 0d 7d 2e U..*&.....&...}.
|
|---|
| 591 | * │ 0110 - ff 1c 2a 4c 95 16 44 ae-29 db cb 45 1e 59 c6 ce ..*L..D.)..E.Y..
|
|---|
| 592 | │ 0120 - c0 8c a5 6f dd 7e 3e e1-6d 7d 0c d4 8e 55 be 07 ...o.~>.m}...U..
|
|---|
| 593 | │ 0130 - 5d d2 c6 62 53 34 09 7c-fc 32 58 bf 8b 2a 37 d0 ]..bS4.|.2X..*7.
|
|---|
| 594 | │ 0140 - e0 3f 67 81 72 4a a9 06-b1 83 32 7c fd d2 a4 40 .?g.rJ....2|...@
|
|---|
| 595 | │ 0150 - 41 13 8c 03 db 2d 12 90-c7 36 3b 46 27 51 4f 65 A....-...6;F'QOe
|
|---|
| 596 | │ 0160 - e4 f8 c3 06 ec b9 4c 04-76 1c 0e 1d 77 0e 86 3d ......L.v...w..=
|
|---|
| 597 | │ 0170 - 42 d3 19 6e ad b9 16 09-41 21 9c a8 a3 50 b8 ad B..n....A!...P..
|
|---|
| 598 | │ 0180 - 80 99 4f 1a c1 36 e4 25-52 22 e7 56 e2 10 b0 b4 ..O..6.%R".V....
|
|---|
| 599 | │ 0190 - 89 2d a0 3f 7c cc d8 9f-80 99 92 fb e4 cd 71 1f .-.?|.........q.
|
|---|
| 600 | │ 01a0 - 14 de d3 82 07 cd 7d 31-78 e2 ec ba 5f a0 b3 07 ......}1x..._...
|
|---|
| 601 | │ 01b0 - 92 df fa 84 cf c7 4f 5b-ca 84 fc ac 80 6b 0f 6b ......O[.....k.k
|
|---|
| 602 | │ 01c0 - 5b a1 f3 a3 89 86 e4 dc-68 93 01 43 57 02 6c ea [.......h..CW.l.
|
|---|
| 603 | │ 01d0 - b3 bc 06 55 37 d5 3a b7-39 50 c0 f9 27 e2 10 a7 ...U7.:.9P..'...
|
|---|
| 604 | │ 01e0 - 63 f7 0e e9 f3 8c 69 6b-63 8f d1 36 1d 3e 49 94 c.....ikc..6.>I.
|
|---|
| 605 | │ 01f0 - 3c 1d c2 00 8d aa b6 ca-d5 eb 78 81 86 ae 5d 24 <.........x...]$
|
|---|
| 606 | │ 0200 - 74 6b e1 3e 75 ef ff d5-e3 ff 84 d5 f0 0e b1 d9 tk.>u...........
|
|---|
| 607 | │ 0210 - 9f c6 d1 a1 82 e4 14 40-84 8d 03 c4 75 5d a9 77 .......@....u].w
|
|---|
| 608 | │ 0220 - 6e eb bd 48 be bc 24 e8-15 41 6e 4f e4 19 8b b6 n..H..$..AnO....
|
|---|
| 609 | │ 0230 - b8 59 d1 30 5c 02 5d 2c-4c 8b 9e b5 45 4b 2b 6a .Y.0\.],L...EK+j
|
|---|
| 610 | │ 0240 - d6 6e 42 2d d3 f3 ba 8a-a7 61 af 68 f0 98 97 d2 .nB-.....a.h....
|
|---|
| 611 | │ 0250 - 11 c6 94 31 58 39 18 57-03 cf 2e 9a 9a ef 69 02 ...1X9.W......i.
|
|---|
| 612 | │ 0260 - b4 c5 f9 65 5c e3 d9 bc-90 3d fe 75 30 ec 74 11 ...e\....=.u0.t.
|
|---|
| 613 | │ 0270 - 4b ba d9 3b 74 60 14 20-e1 33 33 72 d4 b5 5c b3 K..;t`. .33r..\.
|
|---|
| 614 | │ 0280 - 37 ca 23 90 20 a1 bb 5e-3e c7 67 6b 53 e6 fc 9c 7.#. ..^>.gkS...
|
|---|
| 615 | │ 0290 - 1b c5 e0 32 86 8b 8d 90-37 a6 e2 57 61 23 80 99 ...2....7..Wa#..
|
|---|
| 616 | │ 02a0 - 5b fd df 71 22 cd 12 d1-95 32 f7 fd 6b 49 4d a7 [..q"....2..kIM.
|
|---|
| 617 | │ 02b0 - 4f a2 5a 7d 35 da da 50-03 b1 ee 65 f5 9b 2b 3b O.Z}5..P...e..+;
|
|---|
| 618 | │ 02c0 - f5 d2 00 df a1 13 c9 cd-9b d1 68 c7 57 b4 fa a7 ..........h.W...
|
|---|
| 619 | │ 02d0 - ba 97 0e 56 c1 a8 98 89-4b 61 d4 99 24 fc 32 55 ...V....Ka..$.2U
|
|---|
| 620 | │ 02e0 - 6b b0 c6 2a 52 85 19 59-68 b3 95 1d 54 6f 69 92 k..*R..Yh...Toi.
|
|---|
| 621 | │ 02f0 - c1 cf c8 df 72 c6 40 6b-c9 5c ee e7 6b c5 91 9d ....r.@k.\..k...
|
|---|
| 622 | │ 0300 - db 04 0d 1d 1b f1 d5 90-b4 06 48 e6 50 40 1f d9 ..........H.P@..
|
|---|
| 623 | │ 0310 - d7 f0 6b 88 ae c1 94 90-31 de 7a 49 fe 71 4a c4 ..k.....1.zI.qJ.
|
|---|
| 624 | │ 0320 - 52 e4 00 be 94 95 97 67-c0 5b 25 4e 40 0f 1f a0 R......g.[%N@...
|
|---|
| 625 | │ 0330 - 1c eb 2a ce 7d 7b 05 01-e9 8d ed 86 fd af ab 28 ..*.}{.........(
|
|---|
| 626 | │ 0340 - 20 31 c9 33 45 85 51 df-e3 78 f2 e2 3e 37 cb a2 1.3E.Q..x..>7..
|
|---|
| 627 | │ 0350 - fd 46 78 4d a3 08 93 e9-cf 87 63 34 5c a9 37 a6 .FxM......c4\.7.
|
|---|
| 628 | │ 0360 - 05 c0 bb 0c 3c cd 9a 3b-c2 80 e3 6e f6 2d 6a 6d ....<..;...n.-jm
|
|---|
| 629 | │ 0370 - 8d 0d 99 5b d4 53 3b 4a-5c bd ca 26 7f 46 3b 11 ...[.S;J\..&.F;.
|
|---|
| 630 | │ 0380 - a6 cf cb 48 32 c9 0f dd-5a 86 13 61 b7 a5 5e 2c ...H2...Z..a..^,
|
|---|
| 631 | │ 0390 - f5 9b 59 68 d6 98 53 32-ec 94 69 39 6f 16 41 29 ..Yh..S2..i9o.A)
|
|---|
| 632 | │ 03a0 - 79 fd 48 d5 5c ae 7e 2f-99 46 6a 0e 88 1f 05 93 y.H.\.~/.Fj.....
|
|---|
| 633 | │ 03b0 - 5a 0b 6d b7 be 16 bb 9c-73 63 02 53 c2 2e 68 9e Z.m.....sc.S..h.
|
|---|
| 634 | │ 03c0 - 53 8c 63 55 49 53 06 05-2d 88 ed 0d d1 ad d2 8f S.cUIS..-.......
|
|---|
| 635 | │ 03d0 - 44 df ac ab d7 c7 3a 3a-61 8a 00 a6 77 6f a8 20 D.....::a...wo.
|
|---|
| 636 | │ 03e0 - 3e cf 60 94 92 ff fe d3-53 a4 ef 2a fd 75 a8 75 >.`.....S..*.u.u
|
|---|
| 637 | │ 03f0 - d3 c1 2c 6f 29 dc a2 87-3d 56 10 da 29 b0 93 6b ..,o)...=V..)..k
|
|---|
| 638 | │ 0400 - d0 e5 4c b0 d4 65 87 7b-7c be 99 0c 72 03 72 fa ..L..e.{|...r.r.
|
|---|
| 639 | │ 0410 - 8d 15 d6 c6 f9 1f f4 ed-f9 01 62 70 6f d7 fc 30 ..........bpo..0
|
|---|
| 640 | │
|
|---|
| 641 | │ Start Time: 1348910565
|
|---|
| 642 | │ Timeout : 7200 (sec)
|
|---|
| 643 | │ Verify return code: 18 (self signed certificate)
|
|---|
| 644 | [✔] Send HTTP GET.
|
|---|
| 645 | [✔] Get HTTP answer:
|
|---|
| 646 | │ HTTP/1.1 200 OK
|
|---|
| 647 | [✔] End TLS connection.
|
|---|
| 648 | [✔] waiting 0 seconds.
|
|---|
| 649 | [✔] Connect to localhost:4433.
|
|---|
| 650 | [✔] Start TLS renegotiation.
|
|---|
| 651 | *[✔] Check if session was reused:
|
|---|
| 652 | * │ SSL session correctly reused
|
|---|
| 653 | [✔] Get current session:
|
|---|
| 654 | │ Session content:
|
|---|
| 655 | │ SSL-Session:
|
|---|
| 656 | │ Protocol : TLSv1
|
|---|
| 657 | │ Cipher : DHE-RSA-AES256-SHA
|
|---|
| 658 | │ Session-ID: 126A1CC3AC0E73853391E612FD8992DE502A91CEA6F7DB7572882DF4EFF0C496
|
|---|
| 659 | │ Session-ID-ctx:
|
|---|
| 660 | │ Master-Key: E89B9E260BDF67BFEFD4FAE1ED056F4D1BF3FDFD09C50A091A7292756C65430C10C7F131F4C4C557C3A836EC02C3109F
|
|---|
| 661 | │ Key-Arg : None
|
|---|
| 662 | │ Krb5 Principal: None
|
|---|
| 663 | │ PSK identity: None
|
|---|
| 664 | │ PSK identity hint: None
|
|---|
| 665 | * │ TLS session ticket:
|
|---|
| 666 | * │ 0000 - 0b 0b 2d b4 92 c1 b3 ba-fe 01 6f f6 1c 35 0e 3f ..-.......o..5.?
|
|---|
| 667 | * │ 0010 - d9 e5 e8 dd ed 9a f7 82-83 2f 01 4f 88 70 5e 73 ........./.O.p^s
|
|---|
| 668 | * │ 0020 - 88 b0 c8 eb dc 18 2c d3-0f ef 6d dd 6e ce 9e f3 ......,...m.n...
|
|---|
| 669 | * │ 0030 - 85 15 e9 f5 bf 21 38 c0-f6 ce d0 e8 f5 6c 37 54 .....!8......l7T
|
|---|
| 670 | * │ 0040 - 42 46 0f 71 59 c5 45 62-41 20 e6 cc 6a 1f 16 a0 BF.qY.EbA ..j...
|
|---|
| 671 | ......(abbreviated)
|
|---|
| 672 | │ 03c0 - 53 8c 63 55 49 53 06 05-2d 88 ed 0d d1 ad d2 8f S.cUIS..-.......
|
|---|
| 673 | │ 03d0 - 44 df ac ab d7 c7 3a 3a-61 8a 00 a6 77 6f a8 20 D.....::a...wo.
|
|---|
| 674 | │ 03e0 - 3e cf 60 94 92 ff fe d3-53 a4 ef 2a fd 75 a8 75 >.`.....S..*.u.u
|
|---|
| 675 | │ 03f0 - d3 c1 2c 6f 29 dc a2 87-3d 56 10 da 29 b0 93 6b ..,o)...=V..)..k
|
|---|
| 676 | │ 0400 - d0 e5 4c b0 d4 65 87 7b-7c be 99 0c 72 03 72 fa ..L..e.{|...r.r.
|
|---|
| 677 | │ 0410 - 8d 15 d6 c6 f9 1f f4 ed-f9 01 62 70 6f d7 fc 30 ..........bpo..0
|
|---|
| 678 | │
|
|---|
| 679 | │ Start Time: 1348910565
|
|---|
| 680 | │ Timeout : 7200 (sec)
|
|---|
| 681 | │ Verify return code: 18 (self signed certificate)
|
|---|
| 682 | [✔] Send HTTP GET.
|
|---|
| 683 | [✔] Get HTTP answer:
|
|---|
| 684 | │ HTTP/1.1 200 OK
|
|---|
| 685 | [✔] End TLS connection.
|
|---|
| 686 |
|
|---|
| 687 | As we can see the session ticket is bigger as the client certificate form part
|
|---|
| 688 | part of the blob in the session ticket (encrypted by the server key).
|
|---|
| 689 |
|
|---|
| 690 | The renegotiation also works as it says so and the same session ticket.
|
|---|
| 691 |
|
|---|
| 692 | $ tail /usr/local/nginx/logs/access.log
|
|---|
| 693 | 127.0.0.1 - - [29/Sep/2012:19:22:45 +1000] "GET / HTTP/1.0" 200 612 "-" "-" "-" "TLSv1" "/CN=localhost"
|
|---|
| 694 | 127.0.0.1 - - [29/Sep/2012:19:22:45 +1000] "GET / HTTP/1.0" 200 612 "-" "-" "-" "TLSv1" "/CN=localhost"
|
|---|
| 695 |
|
|---|
| 696 | The access logs of nginx have been configured to show the client certificate CN
|
|---|
| 697 | as the last item. We show the here in the logs the the client certificate is
|
|---|
| 698 | also there on the renegotiation.
|
|---|
| 699 |
|
|---|
| 700 | KNOWN DEFICIENCIES
|
|---|
| 701 |
|
|---|
| 702 | It doesn't seem like TLS session ticket lifetime hint isn't set. The openssl
|
|---|
| 703 | print session is used by openssl-client doesn't display it and the code looks
|
|---|
| 704 | like it will if it was set (ssl_txt.c in the openssl source). tlsext_tick_lifetime_hint
|
|---|
| 705 | is an attribute of SSL_SESSION but unsure if it is a stable API.
|
|---|
| 706 |
|
|---|
| 707 | UNTESTED:
|
|---|
| 708 |
|
|---|
| 709 | Windows NGX_THREADS implementation however locking is written.
|
|---|
| 710 |
|
|---|
| 711 | Multi worker operation
|
|---|
