Question

I am trying to create a client – server application, the client written in c++ and QT, and the server in java, but I am having a really hard time trying to get ssl encryption working.
The process fails at handshake level, I think. The reason why I am having such a difficult time trying to figure out why it is not working is because, even though the process fails, no errors are reported in either the client or the server. I use the fallowing an the client side, in QT :

    this->_uCertificate.fromPath(_DC::DEFAULT_CERT_MAIN_PATH + _DC::DEFAULT_MAIN_CERT_FILE);
    this->_socket->addCaCertificate(this->_uCertificate);

    //begin connection
    this->_socket->connectToHostEncrypted(this->_uServerAdress, this->_uServerPort);

    //wait until connection has completed
    if(!this->_socket->waitForConnected(_CM::TIMEOUT))
    {
        this->_lastError = this->_socket->errorString();
        return false;
    }

    //wait for handshake
   if ( !this->_socket->waitForEncrypted(_CM::TIMEOUT) ) {
       this->_lastError =  this->_socket->errorString(); //the error is "No Error"
       //return false;
   }

It fails when calling the “waitForEncrypted”. The function return false, so the process failed, but the error string is “No Error”. I have also added a slot for handling the error signal from the socket, but it is never called. On the server side I use :

 SSLSocket _sock = (SSLSocket) this._ssocket.accept();
_sock.startHandshake();
 ........................................
 if(this._inputBuffered.read(this._messageBuffer) < 0)
                throw new Exception("Error while reading from client");

Again no exceptions are thrown, but it fails at the read command. But on the server side I am no sure if an exception is thrown if the connection / handshake fails, or I should check for the error manually somehow.
I used to have a problem , in the client, when I would receive an error that the common name doesn’t match the host, so at least I know that the connection is somewhat working. After I fixed the certificate to include the right common name, I am receiving this none existing error. Does anyone have an idea why it would fail this way, or at least a better debugging method?

Edit I have tried to connect using openSSL and it works. The handshake succeeds, and I can send and receive packets from the server. So the problem seems to be in the client.

Answer 1

It seemed that I had a problem with the way I was loading certificates from file. The method “fromPath” apparently doesn’t actually load a cert from file, but returnes a list of certificates. If I add this list to my socket, then it works as it should. I am a bit conscience-stricken that I didn’t read the documentation properly.

Edit The reason why it was failing, but still no errors were thrown with signals is because my socket had no valid certificate. When I was calling this->_uCertificate.fromPath(..), the method was returning a list of certificates found at that path, but the object itself was not modified. It still remained a invalid, empty certificate. So when I added that empty certificate in my socket, the only one, when it reached the handshake, It had no valid certificate for the operation. At this point it fails, but no errors are thrown.

But when the objects returned by the .fromPath() methon are added to the socket, then the handshake continues as normal, because now it has valid and non empty cartificates.