MS-Mice DTLS Handshake fails after Flight 4

Question

Hi,
I am having trouble performing the DTLS handshake as part of stream encryption in Ms-Mice. After Flight 4 (ref: RFC6347): which includes: ServerHello, Certificate, ServerKeyExchange, CertificateRequest and ServerHelloDone the client closes the socket. I am not able to find any useful information in Event Viewer. Tried a couple of certificate types without any luck. Tried using the same certificate parameters as used in a successful connection between two windows laptops as well (ecdsa-with-sha1). I am assuming that the certificates can be self signed as I read this in an other forum post. Are there more debugging tools I can use? Are there more requirements to the certificates other than that stated in the documentation?
Update:
Found " [CERT_TRUST_IS_UNTRUSTED_ROOT] true" in the CAPI2 event logs. Should the certificate be signed?

Answer 1

Hi @R2G2
I need more info on your inquiry. Can you please send an email to dochelp at microsoft dot com to my attention so that we can communicate over email?

Regards,
Obaid Farooqi -MSFT

Answer 2

Self-signed certificates are indeed allowed. The reason the windows client closed the socket was due to the certificateRequest message. This message is optional, but should not be used in this case. In OpenSSL this is simply done by setting mode = SSL_VERIFY_NONE using SSL_CTX_set_verify.

Answer 3

Forum update:

I worked with the R2G2 via email and this issue is now resolved.

The problem was that R2G2's server was sending certificate request which Windows DTLS server does not. Removing certificate request resolved the issue.