{"action":"created","issue":{"url":"https://api.github.com/repos/ARMmbed/mbedtls/issues/421","repository_url":"https://api.github.com/repos/ARMmbed/mbedtls","labels_url":"https://api.github.com/repos/ARMmbed/mbedtls/issues/421/labels{/name}","comments_url":"https://api.github.com/repos/ARMmbed/mbedtls/issues/421/comments","events_url":"https://api.github.com/repos/ARMmbed/mbedtls/issues/421/events","html_url":"https://github.com/ARMmbed/mbedtls/issues/421","id":133204752,"number":421,"title":"Verifying peer X.509 certificate: failed","user":{"login":"bmoraine","id":9919777,"avatar_url":"https://avatars.githubusercontent.com/u/9919777?v=3","gravatar_id":"","url":"https://api.github.com/users/bmoraine","html_url":"https://github.com/bmoraine","followers_url":"https://api.github.com/users/bmoraine/followers","following_url":"https://api.github.com/users/bmoraine/following{/other_user}","gists_url":"https://api.github.com/users/bmoraine/gists{/gist_id}","starred_url":"https://api.github.com/users/bmoraine/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bmoraine/subscriptions","organizations_url":"https://api.github.com/users/bmoraine/orgs","repos_url":"https://api.github.com/users/bmoraine/repos","events_url":"https://api.github.com/users/bmoraine/events{/privacy}","received_events_url":"https://api.github.com/users/bmoraine/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ARMmbed/mbedtls/labels/mirrored","name":"mirrored","color":"ededed"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-02-12T10:34:17Z","updated_at":"2016-02-12T14:50:39Z","closed_at":null,"body":"Hello,\r\n\r\nWhen evaluating mbedtls, I notice a strange behavior running  ssl_client1 with ssl_server example programs that share a correct set of certificates (in my understanding).\r\n\r\nIndeed, on client side during hanshaking, the X.509 certificate verification failed although on sever side no error is reported\r\n\r\nFor information, please find below the output of ssl_client1 when I meet the issue :\r\n~~~\r\n  . Seeding the random number generator... ok\r\n  . Loading the CA root certificate ... ok (0 skipped)\r\n  . Connecting to tcp/localhost/4433... ok\r\n  . Setting up the SSL/TLS structure... ok\r\n  . Performing the SSL/TLS handshake.../home/bmoraine/Desktop/mbed/mbedtls-2.2.0/library/ssl_tls.c:4400: x509_verify_cert() returned -9984 (-0x2700)\r\n ok\r\n  . Verifying peer X.509 certificate... failed\r\n  ! The certificate Common Name (CN) does not match with the expected CN\r\n\r\n  > Write to server: 18 bytes written\r\n\r\nGET / HTTP/1.0\r\n\r\n  < Read from server: 150 bytes read\r\n\r\nHTTP/1.0 200 OK\r\nContent-Type: text/html\r\n\r\n<h2>mbed TLS Test Server</h2>\r\n<p>Successful connection using: TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384</p>\r\n/home/bmoraine/Desktop/mbed/mbedtls-2.2.0/library/ssl_tls.c:6509: mbedtls_ssl_read_record() returned -30848 (-0x7880)\r\nLast error was: -30848 - SSL - The peer notified us that the connection is going to be closed\r\n~~~\r\n\r\nRegarding ssl_server output no error is displayed :\r\n\r\n~~~\r\n  . Loading the server cert. and key... ok\r\n  . Bind on https://localhost:4433/ ... ok\r\n  . Seeding the random number generator... ok\r\n  . Setting up the SSL data.... ok\r\n  . Waiting for a remote connection ... ok\r\n  . Performing the SSL/TLS handshake... ok\r\n  < Read from client: 18 bytes read\r\n\r\nGET / HTTP/1.0\r\n\r\n  > Write to client: 150 bytes written\r\n\r\nHTTP/1.0 200 OK\r\nContent-Type: text/html\r\n\r\n<h2>mbed TLS Test Server</h2>\r\n<p>Successful connection using: TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384</p>\r\n\r\n  . Closing the connection... ok\r\n  . Waiting for a remote connection ...\r\n~~~\r\n\r\nI reproduced the same issue using unmodified ssl_client1 and ssl_server example programs on Ubuntu 14.10 for the following versions : v2.2.1, v2.2.0 ,v2.1.4 , v1.3.16, but not with v1.2.19.\r\n\r\nIs there a regression in ssl_client1 example, in the used certificates or in the library itself?\r\n\r\nOr maybe I am missing something or did something wrong ....\r\n\r\nThank you for your help"},"comment":{"url":"https://api.github.com/repos/ARMmbed/mbedtls/issues/comments/183358854","html_url":"https://github.com/ARMmbed/mbedtls/issues/421#issuecomment-183358854","issue_url":"https://api.github.com/repos/ARMmbed/mbedtls/issues/421","id":183358854,"user":{"login":"ciarmcom","id":14747535,"avatar_url":"https://avatars.githubusercontent.com/u/14747535?v=3","gravatar_id":"","url":"https://api.github.com/users/ciarmcom","html_url":"https://github.com/ciarmcom","followers_url":"https://api.github.com/users/ciarmcom/followers","following_url":"https://api.github.com/users/ciarmcom/following{/other_user}","gists_url":"https://api.github.com/users/ciarmcom/gists{/gist_id}","starred_url":"https://api.github.com/users/ciarmcom/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ciarmcom/subscriptions","organizations_url":"https://api.github.com/users/ciarmcom/orgs","repos_url":"https://api.github.com/users/ciarmcom/repos","events_url":"https://api.github.com/users/ciarmcom/events{/privacy}","received_events_url":"https://api.github.com/users/ciarmcom/received_events","type":"User","site_admin":false},"created_at":"2016-02-12T14:50:39Z","updated_at":"2016-02-12T14:50:39Z","body":"ARM Internal Ref: IOTSSL-636"}}