OK, now that looks like some good information.
If the .pfx file required a pass phrase, it contains not only a SSL certificate, but also a SSL private key. Apparently your customer requires you, a SSL client in the context of this connection, to authenticate using a "SSL client certificate". This is a not-so-common way to use SSL, but certainly possible.
If your "openssl pkcs12" command was successful, the .pem file should now contain two segments, like this:
-----BEGIN RSA PRIVATE KEY-----
-----END RSA PRIVATE KEY-----
and:
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
The CERTIFICATE segment may be before or after the PRIVATE KEY segment; the order is not important.
You must now tell "openssl s_client" and "curl" that you have a client certificate that you are willing to use for authentication.
To do that, you must use the "-cert " option with the "openssl s_client" command, i.e.:
openssl s_client -cert YourCertificateFile.pem -connect host:port
This takes care of one half of the authentication problem: when your client presents the certificate to the remote server, the remote server can be assured that you have legitimate business with it.
The s_client command will also display the certificate of the remote server. You can store it and use it later to confirm that you're still accessing the same server, i.e. nobody is trying to redirect your connection to a malicious server.
But the "openssl s_client" will only allow you to confirm that the connection works; it will not actually transfer any files without a major extra effort. To transfer files, you need curl or something similar.
To download files from the remote server, use curl like this:
curl --cert YourCertificateFile.pem https://host:port/path/filename
To upload files to the remote server, you need to know one more thing: which HTTP(S) method you're supposed to use in sending the data? The choices are POST and PUT. PUT is better suited for file transfer, but POST is much more widely supported.
To upload using HTTP(S) PUT method:
curl --cert YourCertificateFile.pem -T localfile https://host:port/path/
or, if you want to specify the remote filename:
curl --cert YourCertificateFile.pem -T localfile https://host:port/path/remotefile
To upload using the POST method, you would use:
curl --cert YourCertificateFile.pem --data-binary @localfile https://host:port/path/destination
If you're supposed to use the POST method in sending data, your client should have given you the *exact* destination URL to use. If you change *anything* in the POST destination URL, your data may not get processed correctly at the remote end.
MK
MK
