haskell-tls/hs-tls

Server doesn't support ECDSA certificates

Closed this issue · 4 comments

josephcsible commented

Whenever I use an ECDSA certificate on my server, all connections fail, and it logs the message HandshakeFailed (Error_Protocol ("credential not found",True,HandshakeFailure)).

Steps to reproduce:

  1. Run this command to generate an RSA keypair: openssl req -x509 -newkey rsa:4096 -keyout rsa.key -out rsa.crt -days 365 -nodes -subj '/CN=localhost'
  2. Run an hs-tls server using that RSA keypair, as a control test
  3. Run this command to generate an ECDSA keypair: openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 -pkeyopt ec_param_enc:named_curve -keyout ecdsa.key -out ecdsa.crt -days 365 -nodes -subj '/CN=localhost'
  4. Run the same hs-tls server using all the same settings, except for now using the ECDSA keypair
ocheron commented

Implementation exists but waiting for the crypto part.
P-256 should come with cryptonite-0.27 if all goes well.

ocheron commented

Support for P-256 added in #436.

plcplc commented

Just want to note that this issue persists.
My setup has acme/letsencrypt issue ECDSA certificates and I'm using tls-1.5.4 and cryptonite-0.27 and I get the same error.

  • 👍1
kazu-yamamoto commented

I confirmed that tls-simpleserver can communicate well with openssl s_client with the following settings:

% openssl ecparam -out ec_key.pem -name secp256r1 -genke
% openssl req -new -key ec_key.pem -x509 -nodes -days 3650 -out ec_cert.pem