SecureStreamSocket + CA PEM : “Unacceptable certificate”

[ngjermundshaug]

I am unable to do a SSL handshake with www1.filemail.com using the code below.

Poco::SharedPtr<Poco::Net::InvalidCertificateHandler> pCert = new Poco::Net::ConsoleCertificateHandler(false);
Poco::Net::Context::Ptr pContext = new Poco::Net::Context(Poco::Net::Context::CLIENT_USE, "", "", "C:\\cacert.pem", Poco::Net::Context::VERIFY_RELAXED, 9, false, "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH");
Poco::Net::SSLManager::instance().initializeClient(0, pCert, pContext);

//CA FILE DOWNLOADED FROM: https://curl.haxx.se/ca/cacert.pem

URI uri("https://www1.filemail.com");
Poco::Net::SecureStreamSocket ss(Poco::Net::SocketAddress(uri.getHost().c_str(), uri.getPort()));
ss.completeHandshake();

===> Unacceptable certificate from 188.138.81.30: application verification failure

https://www1.filemail.com works fine in all browsers - and all tests with openssl and e.g. ssllabs.com says that the certificates are correctly installed. Technicians from both RapidSSL and Trustico have tested and confirmed that the site is fine.

Not 100% sure that it's related to POCO - but I would really appreciate it if someone could try the code snippet above and shed some light on this issue.

Running Windows 10 - VS2013. Have tried on two pc's - on separate networks - same problem.
Have tried both 1.7.4 and 1.7.5 - with OpenSSL 1.0.2h.

[obiltschnig]

Poco::Net::SecureStreamSocket cannot validate certificate against the server's host name because it does not know the host name, only the IP address (through Poco::Net::SocketAddress). You'll have to pass the host name to SecureStreamSocket either via the constructor, or by calling setPeerHostName():

URI uri("https://www1.filemail.com");
Poco::Net::SecureStreamSocket ss(Poco::Net::SocketAddress(uri.getHost().c_str(), uri.getPort()), uri.getHost());
ss.completeHandshake();

[ngjermundshaug]

That worked like a charm!

The code I had actually works for www2.filemail.com but not for www1.filemail.com - so I guess the servers must be configured differently somehow (SNI or something).

Anyways - thanks a lot!