Technical Analysis: Verifying Client Certificate Transmission Using OpenSSL s_client

Technical Background and Problem Description

In SSL/TLS mutual authentication environments, verifying client certificate transmission presents a common technical challenge. Many developers and system administrators encounter situations where servers claim not to have received client certificates, while clients are confident the certificates were properly sent. This information asymmetry often leads to complex troubleshooting processes.

Core Functionality of OpenSSL s_client Tool

OpenSSL s_client is a powerful command-line tool specifically designed for establishing SSL/TLS connections and conducting various tests. It supports multiple debugging options that can display detailed information about each phase of the SSL/TLS handshake process. In client certificate verification scenarios, this tool provides crucial state information and debugging output to help users accurately determine certificate transmission status.

Technical Methods for Verifying Client Certificate Transmission

To verify whether a client certificate has actually been transmitted to the server, the combination of -state and -debug parameters must be used. First, establish a baseline test by running the command without certificate parameters:

openssl s_client -connect host:443 -state -debug

In the output, focus on the following critical sections:

SSL_connect:SSLv3 read server done A
write to 0x211efb0 [0x21ced50] (12 bytes => 12 (0xC))
0000 - 16 03 01 00 07 0b 00 00-03                        .........
000c - <SPACES/NULS>
SSL_connect:SSLv3 write client certificate A

Here, the -state parameter displays SSL handshake state transitions, while the -debug parameter shows the actual raw bytes being transmitted. The 12-byte data packet typically represents a "no client certificate" message.

Evidence of Certificate Transmission

When using certificate parameters, the command becomes:

openssl s_client -connect host:443 -cert cert_and_key.pem -key cert_and_key.pem -state -debug

The corresponding output shows significant changes:

SSL_connect:SSLv3 read server done A
write to 0x7bd970 [0x86d890] (1576 bytes => 1576 (0x628))
0000 - 16 03 01 06 23 0b 00 06-1f 00 06 1c 00 06 19 31   ....#..........1
(*SNIP*)
0620 - 95 ca 5e f4 2f 6c 43 11-                          ..^%/lC.
SSL_connect:SSLv3 write client certificate A

The key evidence includes:

• Significant increase in transmitted bytes (e.g., 1576 bytes), far exceeding the 12 bytes without a certificate
• Readable information in the right-hand column showing identifiable certificate details such as CN (Common Name) and issuer fields
• State information clearly indicating client certificate write operations

Technical Details of Output Interpretation

In the debug output, the -state parameter is responsible for displaying SSL handshake state transitions, helping to locate the current operation within the handshake flow. The -debug parameter provides low-level, byte-wise transmission details, including:

• Transmission direction (write to server)
• Memory address information
• Total bytes transmitted
• Hexadecimal byte dump
• ASCII character representation (right-hand column)

Common Issues and Solutions

In practical applications, even when client certificates are successfully transmitted, various errors may still occur. The Java client certificate implementation issues mentioned in the reference article indicate that certificate transmission is just one part of the complete authentication process. Other potential problems include:

• Certificate chain verification failures
• Key mismatches
• Truststore configuration errors
• Protocol version incompatibilities

Best Practice Recommendations

Based on technical analysis and practical experience, the following methods are recommended to ensure reliable client certificate authentication:

• Always use the -state and -debug combination to verify certificate transmission
• Compare output differences with and without certificate parameters
• Check if transmitted byte counts are reasonable (certificates typically require hundreds to thousands of bytes)
• Verify that output contains identifiable certificate information
• Conduct comprehensive analysis combining server-side logs

Technical Summary

Using the combination of -state and -debug parameters in the OpenSSL s_client tool provides definitive verification of whether client certificates are successfully transmitted to the server during SSL/TLS handshake. The significant increase in transmitted bytes and identifiable certificate information serve as key evidence confirming certificate transmission. This method offers reliable technical means for troubleshooting SSL/TLS mutual authentication, helping to quickly identify and resolve certificate transmission-related issues.