Re: Connecting to a WebDAV server fails with mTLS (client auth)
No it's probably limitation on WinSCP's side. I'll look into it. Thanks for the details. I'll contact you.
- martin
Post a reply
Before posting, please read how to report bug or request support effectively.
Bug reports without an attached log file are usually useless.
Topic review
- FibreTTP
Re: Connecting to a WebDAV server fails with mTLS (client auth)
Hi, that does seem to work! I used this command line to test:
And it returned the expected HTML.
Did I generate my client certificate wrong in some way?
echo -e "GET / HTTP/1.1\r\nHost:<redacted>\r\n\r\n" | openssl s_client -connect <redacted> \
-cert certs/<redacted>/proxy-client_15-cert.crt \
-key certs/<redacted>/proxy-client_15-cert.key \
-cert_chain certs/<redacted>/proxy-client_15-cert.crt \
-CAfile authorities/<redacted>/certs/root_ca.crt \
-state -msg -verify_return_error
And it returned the expected HTML.
Did I generate my client certificate wrong in some way?
- martin
Re: Connecting to a WebDAV server fails with mTLS (client auth)
Please try to add
-cert_chain proxy-client_15-cert.crt to the openssl s_client command.
- FibreTTP
Re: Connecting to a WebDAV server fails with mTLS (client auth)
The client certificate file I am trying with does indeed have the intermediate certificate included (and just in case, I've just tried without it and it presents the same error). This is probably an issue with openssl, but I'm not sure why. Running curl built with the same version of openssl used above, with this command line:
works perfectly fine (and also with curl loading the client cert and key separately, and also with curl loading the CA from the certificate store).
curl --cacert authorities/<redacted>/certs/root_ca.crt -E certs/<redacted>/proxy-client_15-cert.p12:<redacted> --cert-type P12 <redacted>
works perfectly fine (and also with curl loading the client cert and key separately, and also with curl loading the CA from the certificate store).
- martin
Re: Connecting to a WebDAV server fails with mTLS (client auth)
Thanks. Does your
proxy-client_15-cert.crt contain just the leaf certificate? Or also the intermediate one? If just the leaf, would you please try appending the intermediate certificate too, to test if it changes anything?
- FibreTTP
Re: Connecting to a WebDAV server fails with mTLS (client auth)
Hey there, "print" seemingly isn't a valid option in that openssl command, so I removed it. I also used the MSYS2 distribution of openssl, let me know if you need output from that specific build. I'll note that the certificates were all generated with step and step-ca.
I've included the outputs unredacted, so please don't mention the hostname-looking CN in plain text here please :)
The _cafile variant of the connect command output included the -CAfile option pointing to the root certificate, which seemingly allowed the client certificate to be verified. Both of the connections fail with the same error though.
I've included the outputs unredacted, so please don't mention the hostname-looking CN in plain text here please :)
The _cafile variant of the connect command output included the -CAfile option pointing to the root certificate, which seemingly allowed the client certificate to be verified. Both of the connections fail with the same error though.
- martin
Re: Connecting to a WebDAV server fails with mTLS (client auth)
Can you post output of this command?
(redacted if you require)
Also, please try to connect with
You can download Windows build of
https://slproweb.com/download/Win64OpenSSL_Light-3_5_9.exe
(approved by the official OpenSSL site)
openssl pkcs12 -info -in client.p12 -nokeys print(redacted if you require)
Also, please try to connect with
openssl and send the output too:
openssl s_client -connect <hostname>:<port> -cert client.pem -key client.pem -state -msgYou can download Windows build of
openssl from:
https://slproweb.com/download/Win64OpenSSL_Light-3_5_9.exe
(approved by the official OpenSSL site)
- FibreTTP
Connecting to a WebDAV server fails with mTLS (client auth)
Connecting to a WebDAV server with a client certificate returns "Connection failed" with error:
The upstream server is a FileBrowser Quantum (v2.0.9-beta) instance with a Caddy (v2.11.4) instance in front performing TLS termination, and reverse proxying to FileBrowser. It is hosted on a non-standard HTTPS port.
Caddy is serving a non-publicly trusted certificate, which was trusted in WinSCP when prompted, and of which the root CA was already imported into the trusted root certificate authority store in Windows (for the current user only). The same root CA has created a certificate, and it has been bundled with the private key into a P12 file which is loaded by WinSCP as a client certificate in the site settings.
Attempting to connect to the server will fail with the error shown above, but connecting with Firefox with no server configuration changes does work normally (it prompts to send the client certificate, and everything works).
Disabling mTLS in Caddy, then removing the path to the client certificate in WinSCP makes the connection work.
Details:
I have attached a session log, but the server hostname and certificate names are private, so quite a bit is redacted. To me, it looks like the client certificate CN is failing to be matched to something.
Could not read status line: SSL error: tlsv1 alert unknown ca
The upstream server is a FileBrowser Quantum (v2.0.9-beta) instance with a Caddy (v2.11.4) instance in front performing TLS termination, and reverse proxying to FileBrowser. It is hosted on a non-standard HTTPS port.
Caddy is serving a non-publicly trusted certificate, which was trusted in WinSCP when prompted, and of which the root CA was already imported into the trusted root certificate authority store in Windows (for the current user only). The same root CA has created a certificate, and it has been bundled with the private key into a P12 file which is loaded by WinSCP as a client certificate in the site settings.
Attempting to connect to the server will fail with the error shown above, but connecting with Firefox with no server configuration changes does work normally (it prompts to send the client certificate, and everything works).
Disabling mTLS in Caddy, then removing the path to the client certificate in WinSCP makes the connection work.
Details:
- WinSCP version: 6.6.3 RC
- Windows version: Windows 11
- Protocol: WebDAV (TLS)
I have attached a session log, but the server hostname and certificate names are private, so quite a bit is redacted. To me, it looks like the client certificate CN is failing to be matched to something.