title: QsslSocket: Cannot access peer (client) certificate on other peer (server)
body: <p>This is the follow-up to my original problem: <a href="https://stackoverflow.com/questions/22938539/qt-serverclient-app-encryption-fails-updated-with-code">Qt Server+Client App: encryption fails (updated with code)</a>
  Also posted this to Qt Forums: <a href="http://qt-project.org/forums/viewthread/41293/" rel="nofollow noreferrer">http://qt-project.org/forums/viewthread/41293/</a></p>
  
  <p>Hi,</p>
  
  <p>my goal is establishing two-ways authentication for Server+Client apps. I am having a strange problem however. Using certificates generated by XCA and OpenSSL for testing purposes in my Server+Client apps using Qt 5.2.0.</p>
  
  <p>Note: I do not use <code>QSslSocket::ignoreSslErrors()</code> to get past the errors.</p>
  
  <p>2 scenarios:</p>
  
  <p>1)
  Client has valid clientCA, valid local certificate (signed by serverCA, client template) and valid private key set.
  Server has valid serverCA, valid local certificate (signed by clientCA, server template) and valid private key set.</p>
  
  <p>2)
  Client has valid clientCA.
  Server has valid local certificate (signed by clientCA, server template) and valid private key set.</p>
  
  <p>———————-</p>
  
  <p>ad 1)</p>
  
  <p>I can establish secure connection fine but only if I set <code>QSslSocket::peerVerifyMode</code> to <code>VerifyNone</code> on server side (automatically <code>VerifyPeer</code> on the client).</p>
  
  <p>If I do NOT do that I get assigned automatically <code>VerifyPeer</code> mode even though the socket is correctly evaluated as server side (checked <code>SslMode</code> for this). That is apparently contrary to the documentation as it says it should be automatically <code>QueryPeer</code> if the socket is server side. However even setting the socket to <code>QueryPeer</code> manually does not help and the handshake fails the same as with <code>VerifyPeer</code>.</p>
  
  <p>Now the error I get is:</p>
  
  <pre><code>QSslError::CertificateSignatureFailed (4) “The signature of the certificate is invalid”
  </code></pre>
  
  <p>Inspecting the peer certificate on SSL error (and/or encrypted) on the server reveals that no certificate was presented by the peer (the <code>peerCertificate()</code> yields null certificate) so it is no wonder it fails with this error. I cannot get the peer certificate on client side either in this case.</p>
  
  <p>BUT even if <code>VerifyNone</code> is set on server and encryption succeeds I still get the above mentioned error due to peer (client) not presenting its certificate despite the fact that it should NOT be requested in the first place. On client I can get peer (server) certificate in this case.</p>
  
  <p>———————-</p>
  
  <p>ad 2)</p>
  
  <p>This is documentation style scenario, that should be capable of one way authentication only (client authenticating the server). In this case the <code>peerVerifyMode</code> is again selected as <code>VerifyPeer</code> on server by default.</p>
  
  <p>However <code>peerVerifyMode</code> does NOT have any effect on the handshake on server side! Even when set to <code>VerifyPeer</code> it succeeds despite the fact that client has not presented any certificates.</p>
  
  <p>No matter the setting of <code>peerVerifyMode</code> the error occurs the same as in #1 plus two new errors, therefore I get on server:</p>
  
  <pre><code>QSslError::CertificateSignatureFailed (4) “The signature of the certificate is invalid”
  QSslError::UnableToGetLocalIssuerCertificate (11) “The issuer certificate of a locally looked up certificate could not be found”
  QSslError::UnableToVerifyFirstCertificate (12) “No certificates could be verified”
  </code></pre>
  
  <p>Despite these the SSL handshake succeeds regardless of <code>peerVerifyMode</code> on the server side. I get no errors on the client. This once again is contrary to the documentation that clearly states that in case of ANY SSL error the connection is dropped unless they are ignored.</p>
  
  <p>———————————————</p>
  
  <p>I do not understand this behaviour nor how to fix it since I am fairly sure the certificates are ok (the test handshake using the <code>openssl.exe</code> succeeds with verify return code 0 (Ok)). It seems to me that the settings of <code>peerVerifyMode</code> is often ignored though and that in some cases errors are automatically ignored as well. Since they are related to unsent (or not received) peer (client) certificate on the server side I can understand it but not if the <code>peerVerifyMode</code> is set to <code>VerifyPeer</code>.</p>
  
  <p>Can anybody help? Thank you!</p>