Re: Problem in establishing SSL handshake between cimom and client

SSL has two modes - certificates or username/password.  You seem to be 
trying to use a combination of each.  First you need to figure out which 
you want to do.

I have a client app that uses SSL with username/password - the following 
works:
     client.connect(hostName, portNumber,
                    SSLContext (String::EMPTY, NULL, String::EMPTY),
                    userName, password);
hostName, portNumber, userName, password are all pulled from argv.

I have not been able to get certificates to work, but have not spent 
much time trying.

My recollection was that this set of parameters for SSLContext is 
completely missing from the Pegasus docs.  I found it in VMware example 
code and got the details from the Pegasus code.

Paul

On 3/30/2010 2:42 PM, [email protected] wrote:
>
> Hi All,
>
> Hi All,
>
> I have build open-pegasus binaries (openssl enabled) in both windows 
> and linux using the following binaries -
>
> openpegasus-2.9.1
> openssl -0.9.8m
>
> with comile-time env vars : PEGASUS_HAS_SSL and OPENSSL_HOME properly set.
> In linux openssl got installed (by default) in /usr/local/ssl.
>
> Then I created a self-signed public key certificate 
> "MyPublicKeyCertificate.pem" using the "openssl" tool. Configured the 
> cimom
> to use openssl and the public key certificate using the "cimconfig" 
> tool. And then added the certificate in cimserver_trust directory 
> using the "ssltrustmgr" tool.
>
> ==================================================================================================================================
> STEPS
> -----------
> 1. openssl genrsa -out MyPrivateKey.pem 1024 (Created the Private Key)
> 2. openssl req -config /usl/local/ssl/openssl.cnf -new -key 
> MyPrivateKey.pem -out MyCertificateSigningRequestFile.csr
>     (Created the CSR, during its creation it asked for a password, I 
> supplied one)
> 3. openssl x509 -in MyCertificateSigningRequestFile.csr -out 
> MyPublicKeyCertificate.pem -req -signkey MyPrivateKey.pem -days 365
>
> 4. cimconfig -s enableHttpsConnection=true -p
> 5. cimconfig -s httpsPort=5989 -p
> 6. cimconfig -s sslClientVerificationMode=required -p
> 7. cimconfig -g sslTrustStore (Currentvalue : cimserver_trust)
> 8. cimconfig -s sslTrustStoreUserName=root -p
> 9. cimconfig -s sslKeyFilePath=MyPrivateKey.pem -p
> 10. cimconfig -s sslCertificateFilePath=MyPublicKeyCertificate.pem -p
>
> 11. ssltrustmgr -a -t cim_trust -c root -f MyPublicKeyCertificate.pem 
> (Certificate added successfully)
> 12. ls cimserver_trust (a6282099.0)
> 13. copy cimserver_trust/a6282099.0 to 
> <client-machine>/home/clientCertDirectory/.
>
> 14. In Client-Machine
>      --------------------------
>
>      Client Application Code -
>
>      CIMClient client;
>      
> client.connect("<cimom-ip>",5989,SSLContext("/home/clientCertDirectory",NULL),"root","<root-password>");
>                                                                         OR
>      
> client.connect("<cimom-ip>",5989,SSLContext("/home/clientCertDirectory/a6282099.0",NULL),"root","<root-password>");
>      instanceName = client.enumerateInstanceNames( <Namespace>, 
> <classname> );
>
>      On executing the client application, it is throwing an exception 
> "ERROR : Connection closed by CIMServer"
>
> ==================================================================================================================================
>
> I think the public key certificate is properly created, but I am 
> unable to use it properly in the client-side (SSLContext object).
> I coundn't find much help in previous open-pegasus mail threads. If 
> anyone can help me point out my error, it would be very
> helpful.
>
> Thanks in Advance,
> Biswapratap.
>
>
>
>
> * Please do not print this email unless it is absolutely necessary. *
>
> The information contained in this electronic message and any 
> attachments to this message are intended for the exclusive use of the 
> addressee(s) and may contain proprietary, confidential or privileged 
> information. If you are not the intended recipient, you should not 
> disseminate, distribute or copy this e-mail. Please notify the sender 
> immediately and destroy all copies of this message and any attachments.
>
> WARNING: Computer viruses can be transmitted via email. The recipient 
> should check this email and any attachments for the presence of 
> viruses. The company accepts no liability for any damage caused by any 
> virus transmitted by this email.
>
> www.wipro.com
>