1

I am running an openssl server on my CentOS device. I am using an expired certificate and expect to see a "Certificate authority error" msg in /var/log/messages, but there is no authentication msgs being recorded by my syslog. How can I fix this?

Expected msg:

Certificate error: authority and subject key identifier mismatch

Steps: On Server:

openssl s_server -debug -accept 4443 -cert /tmp/expired.crt -key /tmp/expired.key -tls1 -no_dhe -WWW -cipher DES-CBC3-SHA 1>/tmp/server-normal-tls1-DES-CBC3-SHA-STDOUT 2>/tmp/server-normal-tls1-DES-CBC3-SHA-STDERR &

On Client: openssl s_client -connect 5.0.0.1:4443 -tls1 -CAfile /tmp/all.pem -cipher DES-CBC3-SHA 1>/tmp/client-normal-tls1-DES-CBC3-SHA-STDOUT 2>/tmp/client-normal-tls1-DES-CBC3-SHA-STDERR; echo

Observed /var/log/messages on server:

[root@<hostname> ~]# cat /var/log/messages

<6>1 2020-07-01T00:04:46.230901+05:30 <hostname> kernel  - - e1000: eth0 NIC Link is Up 1000 
Mbps Full Duplex, Flow Control: None
<6>1 2020-07-01T00:04:46.238043+05:30 <hostname> kernel  - - ADDRCONF(NETDEV_UP): eth0: link is not ready
<6>1 2020-07-01T00:04:46.238084+05:30 <hostname> kernel  - - 8021q: adding VLAN 0 to HW     filter on device eth0
<6>1 2020-07-01T00:04:46.263186+05:30 <hostname> kernel  - - ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
<189>1 2020-07-01T00:04:46.354565+05:30 <hostname> NET 3206 - -  /etc/sysconfig/network-scripts/ifup-post : updated /etc/resolv.conf
<6>1 2020-07-01T00:04:46.421362+05:30 <hostname> kernel  - - e1000: eth1 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None
<6>1 2020-07-01T00:04:46.428795+05:30 <hostname> kernel  - - ADDRCONF(NETDEV_UP): eth1: link is not ready
<6>1 2020-07-01T00:04:46.428838+05:30 <hostname> kernel  - - 8021q: adding VLAN 0 to HW filter on device eth1
<6>1 2020-07-01T00:04:46.444970+05:30 <hostname> kernel  - - ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready
<6>1 2020-07-01T00:04:46.581818+05:30 <hostname> kernel  - - e1000: eth2 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None
<6>1 2020-07-01T00:04:46.589378+05:30 <hostname> kernel  - - ADDRCONF(NETDEV_UP): eth2: link is not ready
<6>1 2020-07-01T00:04:46.589391+05:30 <hostname> kernel  - - 8021q: adding VLAN 0 to HW filter on device eth2
<6>1 2020-07-01T00:04:46.605267+05:30 <hostname> kernel  - - ADDRCONF(NETDEV_CHANGE): eth2: link becomes ready
<189>1 2020-07-01T00:04:47.419669+05:30 <hostname> NET 3368 - -  /etc/sysconfig/network-scripts/ifdown-post : updated /etc/resolv.conf
<6>1 2020-07-01T00:04:47.829926+05:30 <hostname> kernel  - - e1000: eth1 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None
<6>1 2020-07-01T00:04:47.842681+05:30 <hostname> kernel  - - ADDRCONF(NETDEV_UP): eth1: link is not ready
<6>1 2020-07-01T00:04:47.842802+05:30 <hostname> kernel  - - 8021q: adding VLAN 0 to HW filter on device eth1
<6>1 2020-07-01T00:04:47.871609+05:30 <hostname> kernel  - - ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready
<30>1 2020-07-01T00:04:48.209339+05:30 <hostname> dnsmasq 1911 - -  reading /etc/resolv.conf
<30>1 2020-07-01T00:04:48.209377+05:30 <hostname> dnsmasq 1911 - -  using nameserver 10.204.208.221#53
<30>1 2020-07-01T00:04:48.209389+05:30 <hostname> dnsmasq 1911 - -  using nameserver 10.204.208.219#53
<30>1 2020-07-01T00:04:48.209398+05:30 <hostname> dnsmasq 1911 - -  using nameserver 10.216.116.220#53
<30>1 2020-07-01T00:04:48.209416+05:30 <hostname> dnsmasq 1911 - -  using local addresses only for unqualified names
<6>1 2020-07-01T00:04:48.821696+05:30 <hostname> kernel  - - e1000: eth2 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None
<6>1 2020-07-01T00:04:48.829409+05:30 <hostname> kernel  - - ADDRCONF(NETDEV_UP): eth2: link is not ready
<6>1 2020-07-01T00:04:48.829418+05:30 <hostname> kernel  - - 8021q: adding VLAN 0 to HW filter on device eth2
<6>1 2020-07-01T00:04:48.845368+05:30 <hostname> kernel  - - ADDRCONF(NETDEV_CHANGE): eth2: link becomes ready
<13>1 2020-07-01T00:12:41.993789+05:30 <hostname> root 3800 - -  hello
<6>1 2020-07-01T00:28:41.528583+05:30 <hostname> kernel  - - Kernel logging (proc) stopped.
<46>1 2020-07-01T00:28:41.539523+05:30 <hostname> rsyslogd  - -  [origin software="rsyslogd" swVersion="5.8.10" x-pid="1229" x-info="http://www.rsyslog.com"] exiting on signal 15.

/etc/rsyslog.conf configuration:

#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;user;auth;authpriv;cron.none;syslog;daemon                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 *

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log
  • Even if openssl s_server was writing to the system log, why would you expect this message to appear on the server log. A server certificate is verified by the client not the server. Specifically an expired certificate fails because the client's system clock say's the time/date is in the future of the end date on the certificate. AFAIK the server doesn't know why the client is refusing to accept the certificate. – Philip Couling Jul 2 at 9:00
1

Simply because whichever software you are using isn't sending messages to the system logger. OpenSSL on its own is not meant to be run as a daemon and not configured by default (or at all) to log into the system logger.

Processes have to deliberately issue messages to the system logger for rsyslog (or another system logger) to pick them up and eventually write them on a log file or somewhere else.

| improve this answer | |
0

You are asking why an SSL server (openssl s_server) is not recording the reason for it's own SSL server certificate failing verification.

I don't believe that's possibe. The server certificate is not (usually) verified by the server.

The server certificate is verified by the client. Specifically an expired certificate fails because the "Not after date" is in the past with respect to the system clock on the client. Since the server doesn't know (it can only guess) what time the client thinks it is, the server will never truely know if the certificate will be accepted by the client.

AFAIK when a certificate fails verification on the client, the client doesn't inform the server of why that verification failed. It just closes the connection because it doesn't trust the server at all.


As Pedro points out openssl s_server is not expected to write to the system log. Even if it is able to determine the reason for the client's disconnect, there's no option for it to do so (AFAIK). You need to capture the output and post it through a syslog client such as logger.

| improve this answer | |
  • Thanks for your response @PhilipCouling. How will I be able to check the reason of authentication failure on the client in this case? There would be some log msg stating the reason of auth failure. – N.C. Jul 2 at 9:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.