security - how to validate 2-way SSL certificates? -


i need validate client server's certificate.how can @ tcp level , @ http level? http use curl client library.openssl ssl library.this has done through self signed certificates only.which web server or http server need use validates client's ssl certificate?

since using self-signed certificates, can configure certificate though 1 , authorized ca. if peer presents certificate, accepted because appears in list of cas. if peer presents other certificate (or no certificate), should rejected.

you didn't programming language using libcurl, here's pycurl example verifying server:

req.setopt(pycurl.ssl_verifypeer, 1) req.setopt(pycurl.cainfo, "/the/path/to/the/certificate/we/want/the/peer/to/use")

and of course client wants authenticate server:

req.setopt(pycurl.sslcert, "/the/certificate/the/client/will/present") req.setopt(pycurl.sslkey, "/the/private/key/that/goes/with/it/in/pem/format")

as server side, it's easy configure well, depends web server software you're using.

edit: elaboration requested on "you can configure certificate though 1 , authorised ca".

normally, peer presents certificate, , local end validates against ca (or list of cas). ca different certificate peer's certificate. ca certificate has either directly or indirectly signed peer's certificate.

when using self-signed certificate, peer can present certificate. local end can pretend same certificate ca certificate. because certificate signed (by definition), qualifies in case being signed valid ca... since valid ca itself!.


Comments

Post a Comment

Popular posts from this blog

blackberry 10 - how to add multiple markers on the google map just by url? -

i have android application, want convert blackberry 10 , google map needed in app,but blackberry 10 not support googlemap , blackberry developer web site supply way replace it.the sample below: @override public void oncreate(bundle savedinstancestate) { super.oncreate(savedinstancestate); setcontentview(r.layout.main); webview webview = (webview) findviewbyid(r.id.mywebview); webview.getsettings().setjavascriptenabled(true); webview.loadurl("http://maps.google.com/?ll=36.97, -122&lci=bike&z=13&t=p"); } i cannot understand it,i not know how add multiple markers on googlemap via url? can me? this worked me map shown in webview.
Read more

php - guestbook returning database data to flash -

i've been struggling problem long , unable make work, hope can me it. first, know php files correct , mysql database works fine. in flash, able submit comment database comments not display. did many tests such making returned_database flash separately , worked fine - can see old comments. long combine submitting 1 , returning 1 together, flash doesn't show comments more. put lower version flash effects on frame thinking doesn't collaborate returning flash, submitting flash works fine. since pretty complex problem hard me copy actionscript code because on different frames in flash. if has ideas fixing maybe can send file you?
Read more

delphi - Dynamic file type icon -

i want register file type in windows , make program delphi draw icon of file according contents (something custom icon format). how can this? thanks nortd , user539484 comments, searched internet "shell icon handler delphi" , found sample here , , shell+ components has component this.
Read more