openssl 客户端证书对我不起作用（TLS1.3）

Question

我正在使用以下 OpenSSL 命令行：

openssl s_server -tls1_3 -state -Verify 1 -key Nexus_Dev.pk8 -cert Nexus_Dev.crt -CAfile NexusDevCA.my.cer -accept 3443 -tlsextdebug

我想创建通过 TLS1.3 请求客户端证书的服务器。第一个请求浏览器确实显示证书提示。选择证书后，它会要求在命令提示符下输入命令。我输入“c”，这意味着向客户端重新请求证书。但这给了我错误

8002943DE27F0000:error:0A000117:SSL routines:SSL_verify_client_post_handshake:extension not received:ssl/ssl_lib.c:5848:

我在这里粘贴完整的输出。看起来可能是 OpenSSL 中的一些错误。

vijay@vijay-dev-machine:~/openssl/OpenSSL_1_1_0-stable/apps$ openssl s_server -tls1_3 -state -Verify 1 -key Mytest_Dev.pk8 -cert Mytest_Dev.crt -CAfile MytestDevCA.my.cer -accept 3443 -tlsextdebug
verify depth is 1, must return a certificate
Using default temp DH parameters
ACCEPT
SSL_accept:before SSL initialization
SSL_accept:before SSL initialization
TLS client extension "server name" (id=0), len=14
0000 - 00 0c 00 00 09 6c 6f 63-61 6c 68 6f 73 74         .....localhost
TLS client extension "extended master secret" (id=23), len=0
TLS client extension "renegotiation info" (id=65281), len=1
0000 - 00                                                .
TLS client extension "supported_groups" (id=10), len=14
0000 - 00 0c 00 1d 00 17 00 18-00 19 01 00 01 01         ..............
TLS client extension "EC point formats" (id=11), len=2
0000 - 01 00                                             ..
TLS client extension "session ticket" (id=35), len=0
TLS client extension "application layer protocol negotiation" (id=16), len=14
0000 - 00 0c 02 68 32 08 68 74-74 70 2f 31 2e 31         ...h2.http/1.1
TLS client extension "status request" (id=5), len=5
0000 - 01 00 00 00 00                                    .....
TLS client extension "key share" (id=51), len=107
0000 - 00 69 00 1d 00 20 28 0d-42 4f 38 0b 7b 26 7c 87   .i... (.BO8.{&|.
0010 - d1 82 25 db e6 9e 4d e3-31 9f d2 4e 68 76 bc 5a   ..%...M.1..Nhv.Z
0020 - 4c bd f2 55 47 3c 00 17-00 41 04 d8 b0 e9 90 e5   L..UG<...A......
0030 - 3e b4 4e 14 ac 0b b1 5f-9f 11 08 69 e7 58 50 bb   >.N...._...i.XP.
0040 - 73 05 33 f2 62 2e 9c 06-6e d1 8b aa cf 3b 91 19   s.3.b...n....;..
0050 - 20 00 44 fa ff 83 8e c4-60 c7 35 fb 5f 3d 8b 71    .D.....`.5._=.q
0060 - 98 de 77 72 80 fc 71 ad-c6 84 06                  ..wr..q....
TLS client extension "supported versions" (id=43), len=5
0000 - 04 03 04 03 03                                    .....
TLS client extension "signature algorithms" (id=13), len=24
0000 - 00 16 04 03 05 03 06 03-08 04 08 05 08 06 04 01   ................
0010 - 05 01 06 01 02 03 02 01-                          ........
TLS client extension "psk kex modes" (id=45), len=2
0000 - 01 01                                             ..
TLS client extension "TLS padding" (id=21), len=141
0000 - 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
0010 - 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
0020 - 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
0030 - 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
0040 - 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
0050 - 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
0060 - 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
0070 - 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
0080 - 00 00 00 00 00 00 00 00-00 00 00 00 00            .............
SSL_accept:SSLv3/TLS read client hello
SSL_accept:SSLv3/TLS write server hello
SSL_accept:SSLv3/TLS write change cipher spec
SSL_accept:TLSv1.3 write encrypted extensions
SSL_accept:SSLv3/TLS write certificate request
SSL_accept:SSLv3/TLS write certificate
SSL_accept:TLSv1.3 write server certificate verify
SSL_accept:SSLv3/TLS write finished
SSL_accept:TLSv1.3 early data
SSL_accept:TLSv1.3 early data
depth=1 C=IN, ST=MH, L=Pune, O=Mytest Dev CA, OU=Mytest Dev CA, CN=MytestDevCA.my, [email protected]
verify return:1
depth=0 C=IN, ST=MH, L=Pune, O=Mytest User, OU=Mytest Dev User, CN=MytesteDev.user, [email protected]
verify return:1
SSL_accept:SSLv3/TLS read client certificate
SSL_accept:SSLv3/TLS read certificate verify
SSL_accept:SSLv3/TLS read finished
SSL_accept:SSLv3/TLS write session ticket
SSL_accept:SSLv3/TLS write session ticket
-----BEGIN SSL SESSION PARAMETERS-----
MIIEbwIBAQICAwQEAhMBBCD5VPGfGA+NCKZEvRSuxMNWICu8ebxp5WWDy7hqunSN
kwQgHhjRwB7I/pQCGsXyMXT8iq+KRK4Pu9RscJMXpSgyZPuhBgIEYffGpqIEAgIc
IKOCA/gwggP0MIIC3KADAgECAgMJmZMwDQYJKoZIhvcNAQELBQAwgZQxCzAJBgNV
BAYTAklOMQswCQYDVQQIEwJNSDENMAsGA1UEBxMEUHVuZTEVMBMGA1UEChMMTmV4
dXMgRGV2IENBMRUwEwYDVQQLEwxOZXh1cyBEZXYgQ0ExFjAUBgNVBAMTDU5leHVz
RGV2Q0EubXkxIzAhBgkqhkiG9w0BCQEWFG5leHVzQG5leHVzaW5kaWEuY29tMB4X
.....
K8sr4VeE6ffl6l1OZdWeFtscJnVjqwhNITKRvzAueR/ihV6Teh6U6BzYn9g8qEhw
Y0juXb9GIhW1zcKiIPyPVnM7wSPmv0uVP4t5f4ap/DF9eXFDzMnupa9Locqzt29I
WBP6NrbkAzFO+aEIiaQGBAQBAAAArgcCBQDEKyqFswMCAR0=
-----END SSL SESSION PARAMETERS-----
Client certificate
-----BEGIN CERTIFICATE-----
MIID9DCCAtygAwIBAgIDCZmTMA0GCSqGSIb3DQEBCwUAMIGUMQswCQYDVQQGEwJJ
TjELMAkGA1UECBMCTUgxDTALBgNVBAcTBFB1bmUxFTATBgNVBAoTDE5leHVzIERl
diBDQTEVMBMGA1UECxMMTmV4dXMgRGV2IENBMRYwFAYDVQQDEw1OZXh1c0RldkNB
Lm15MSMwIQYJKoZIhvcNAQkBFhRuZXh1c0BuZXh1c2luZGlhLmNvbTAeFw0yMTEy
MDkwNjUyMDBaFw0yNjEyMDkwNjUyMDBaMIGVMQswCQYDVQQGEwJJTjELMAkGA1UE
.....
BDARBglghkgBhvhCAQEEBAMCB4AwDQYJKoZIhvcNAQELBQADggEBAAjHwWrjojon
mHKRMhVVvEsh3SXNv9sZLUJEbH94QcPa/8+JHMJ5GFVVb5nJE9++qbVjsZLdzvb0
7rMI/+q6w2sLg5WmERmNzk10kXEJyYkH5gSiTHVWbmMHbxsMXze/LAzkpMOtWoId
VgMpyuEWd1vQMEfjZwLK7PYZHC0Ilrj8BIs2HC+WknFN/gG3pGGi5aQzdSvLK+FX
hOn35epdTmXVnhbbHCZ1Y6sITSEykb8wLnkf4oVek3oelOgc2J/YPKhIcGNI7l2/
RiIVtc3CoiD8j1ZzO8Ej5r9LlT+LeX+GqfwxfXlxQ8zJ7qWvS6HKs7dvSFgT+ja2
5AMxTvmhCIk=
-----END CERTIFICATE-----
subject=C=IN, ST=MH, L=Pune, O=Mytest User, OU=Mytest Dev User, CN=MytesteDev.user, [email protected]
issuer=C=IN, ST=MH, L=Pune, O=Mytest Dev CA, OU=Mytest Dev CA, CN=MytestDevCA.my, [email protected]
Shared ciphers:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA
Signature Algorithms: ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA1:RSA+SHA1
Shared Signature Algorithms: ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Supported groups: x25519:secp256r1:secp384r1:secp521r1:ffdhe2048:ffdhe3072
Shared groups: x25519:secp256r1:secp384r1:secp521r1:ffdhe2048:ffdhe3072
CIPHER is TLS_AES_128_GCM_SHA256
This TLS version forbids renegotiation.
GET / HTTP/1.1
Host: localhost:3443
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Cache-Control: max-age=0

c
Failed to initiate request
8002943DE27F0000:error:0A000117:SSL routines:SSL_verify_client_post_handshake:extension not received:ssl/ssl_lib.c:5848:

Answer 1

我可以找到原因并将其发布给其他人帮助

---

通过 TLS1.3 进行证书身份验证

在 SSL/TLS 握手期间，服务器向客户端请求证书，客户端用证书进行响应。该证书用于服务器的身份验证。在握手期间浏览器提示输入证书。以下是示例快照

选定的证书由浏览器提交到服务器以进行身份验证。

TLS1.3 中存在协议更改，因此“不允许”重新协商。协议变更解释如下。 如果是 TLS1.3，客户端在与服务器协商 TLS 连接时必须发送 post_handshake_auth 扩展。

https://datatracker.ietf.org/doc/html/rfc8446#section-4.6.2

方便参考：

4.6.2。 握手后身份验证

当客户端发送了“post_handshake_auth”扩展（参见第 4.2.6 节）时，服务器可以在握手完成后的任何时间通过发送 CertificateRequest 消息来请求客户端身份验证。 客户端必须用适当的身份验证消息进行响应（参见第 4.4 节）。 如果客户端选择进行身份验证，则必须发送证书、CertificateVerify、

Rescorla 标准轨道 [第 75 页]

RFC 8446 TLS 2018 年 8 月

---

完成。 如果拒绝，它必须发送一条不包含证书的证书消息，后跟 Finished。 给定响应的所有客户端消息必须连续出现在线路上，中间没有其他类型的消息。

在未发送“post_handshake_auth”扩展的情况下接收到 CertificateRequest 消息的客户端必须发送“unexpected_message”致命警报。

注意：由于客户端身份验证可能涉及提示用户，因此服务器必须为一些延迟做好准备，包括在发送证书请求和接收响应之间接收任意数量的其他消息。 此外，连续接收多个证书请求的客户端可能会以与接收顺序不同的顺序响应它们（certificate_request_context 值允许服务器消除响应的歧义）。

目前只有 Firefox 支持通过高级选项启用握手后身份验证标志。我试图为 chrome 找到类似的选项，但找不到。

---

目前仅 Firefox 浏览器支持此协议更改。无论如何，我找不到为任何其他浏览器启用上述选项。这意味着仅 Firefox 支持通过 TLS1.3 进行的证书身份验证。

Chrome 和其他浏览器可能会在未来版本中添加此功能。