https://github.com/lukebakken/erlang-otp-8482

https://github.com/erlang/otp/issues/8482
https://github.com/lukebakken/erlang-otp-8482

Last synced: 8 days ago
JSON representation

https://github.com/erlang/otp/issues/8482

• Host: GitHub
• URL: https://github.com/lukebakken/erlang-otp-8482
• Owner: lukebakken
• License: unlicense
• Created: 2024-05-15T13:37:18.000Z (6 months ago)
• Default Branch: main
• Last Pushed: 2024-05-20T18:16:09.000Z (6 months ago)
• Last Synced: 2024-05-20T21:30:56.470Z (6 months ago)
• Language: Erlang
• Homepage: https://github.com/erlang/otp/issues/8482
• Size: 7.81 KB
• Stars: 0
• Watchers: 1
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
# Setup

* Initialize submodules

    ```

    git submodule update --init

    ```

* Generate certs

    * The `DOMAIN` argument _must_ start with a dot `.`

    * The `CN` argument must be a host in the `DOMAIN`

    ```

    make -C tls-gen/one_intermediate DOMAIN=.foo.bar CN=host.foo.bar

    ```

# Reproducing issue

* In one terminal, run TLS server:

    ```

    ./run-tls-server.sh

    ```

* In another terminal, run TLS client:

    ```

    ./run-tls-client.sh

    ```

* The TLS server should log the following:

    ```

    =NOTICE REPORT==== 15-May-2024::07:03:08.770115 ===

    TLS server: In state wait_cert at ssl_handshake.erl:2115 generated SERVER ALERT: Fatal - Bad Certificate

    =ERROR REPORT==== 15-May-2024::07:03:08.770926 ===

    ssl:handshake Error: {error,

                            {tls_alert,

                                {bad_certificate,

                                    "TLS server: In state wait_cert at ssl_handshake.erl:2115 generated SERVER ALERT: Fatal - Bad Certificate\n"}}}

    ```

# Workaround

To "resolve" the issue, comment-out the `nameConstraints` extension in

`tls-gen/one_intermediate/openssl.cnf`, and re-generate certificates. The above

steps will succeed.

# OpenSSL server

* In one terminal, run OpenSSL TLS server:

    ```

    ./run-openssl-server.sh

    ```

* In another terminal, run TLS client:

    ```

    ./run-tls-client.sh

    ```

* Both client and server should report success.