TCP connection using SSL configuration

[Walter Beatty]

I am somewhat new to Cloverleaf and all of our organizations existing interfaces with outside vendors are all configured using a VPN.  We are trying to configure an interface using SSL.  I was provided the certs (.pfx files) from the vendor and no private key needed.  I have imported these certs into the trusted root cert authority on the cloverleaf server.   I have the host IP and port configured and my SSL config :
Mode = Client

SSL Protocol=All

no SSL Cipher Suites

So my confusion is what needs to go in

certificate file:

Private Key:

Password:

Currently in the certificate file I have the full path to the .pfx file – E:/cloverleaf/cis19.1/integrator/client/certs/orders.pfx

nothing in the Private Key as the vendor stated there was no private key and the password I have the password provided from the vendor.

When I start the thread I see a secure socket handshake error and we log the following error:

[ssl :open:ERR /0:to_retinavue_orm:06/21/2022 08:40:18] Unable to load Server’s Certificate from file: ‘E:/cloverleaf/cis19.1/integrator/client/certs/orders.pfx’ iRes = 0
[ssl :open:ERR /0:to_retinavue_orm:–/–/—- –:–:–] Socket will be closed…
[pdl :PDL :ERR /0:to_retinavue_orm:06/21/2022 08:40:18] Unable to setup SSL socket

 

Any advise would be greatly appreciated.

Topic

[David Barr]

If you’re trying to authenticate the server, I think you need to use ClientAuth mode, put the server certificate in a file, and fill in the CA path and CA file with the path and filename for this file. I think you need to use Portecle to convert the pfx file to pem format.

I wasn’t able to get this mode working because this also sends a client certificate to the server, and this was confusing the server I was trying to connect to. I ended up switching to ClientAnon mode and not entering any certificate details in the thread. It would be nice if there was another mode for client threads that would authenticate the server but not try to send a client cert.

[Mike Grieger]

Walter – I’m wondering if you need to convert the Cert format so Cloverleaf can recognize it?  Is the .pfx in binary (not PEM/ASCII format)?  Thought it needed to be PEM format.

[Walter Beatty]

Thanks Mike – I did have to convert to PEM format but was trying to do so from Windows cert manager and since I did not have a private key from the vendor cert I was not able to generate a key in PEM format from Windows.  I had to use Portecle to do that.  I was able to get it to work after doing that.

[Author]

Replies