Client SSL: fall back to passcode auth on invalid client certs

[ge0rg]

Hi,

Currently, if a client connects to the SSL port (24580), the client certificate is checked after receiving the user line from the client, and if the certificate check fails, the connection is reset:

<<< # aprsc 2.1.2-gc90ee9c
>>> user DO1GL pass -1 vers foo -1
<<< # Client certificate not accepted: unable to verify the first certificate
read:errno=0

It would be a nice graceful fallback to allow a client to perform passcode authentication if the client certificate is not accepted by the server (that might be caused by a mismatching root or by an expired client cert).

This might introduce some problems, though:

• should a client with an invalid cert and invalid passcode be rejected or accepted as unauthorized?
• will this cause debugging problems when a user thinks they are authenticated, while they actually aren't?

[kd7lxl]

Have you considered adding logic to the client to fall back to port 14580 if there is any problem on 24580? This would be backwards compatible, even for servers that never supported TLS.

[ge0rg]

Actually, my client does contain that exact logic. However, As the SSL connection is established successfully, and data is exchanged in both directions, the client goes on with it beyond the point where it would fallback to non-TLS.

From the client's point of view, this looks like a random disconnect (e.g. a network change) after the socket has been established.

[hessu]

It might be good for the server to provide both a machine-readable, documented error code in the login reply, as well as a human-readable english string, so that the client app could make a decision based on that.

[ge0rg]

That's a great idea. As APRS-IS-SSL is undefined until now, we can establish some useful response format, wrapped inside a legacy comment if you wish so.

[irl]

fall back to passcode auth on invalid client certs would be great also to just allow people to use TLS without needing a client cert. Working on some code yesterday I must have wasted an hour trying to login with a passcode while I waited for the lotw cert to appear.