You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2016/05/08 10:49:08 UTC
[Bug 59438] New: ServerInfo Extension 18 Missing for dual EC-RSA
certificate configurations
https://bz.apache.org/bugzilla/show_bug.cgi?id=59438
Bug ID: 59438
Summary: ServerInfo Extension 18 Missing for dual EC-RSA
certificate configurations
Product: Apache httpd-2
Version: 2.4.20
Hardware: PC
OS: Linux
Status: NEW
Severity: major
Priority: P3
Component: mod_ssl
Assignee: bugs@httpd.apache.org
Reporter: jasonmili@hotmail.com
I have received no response from Apache Dev Mailing List for 5 days.
I would like to draw your attention to a new patch for OpenSSL which will
ultimately mean that Apache needs to treat dual EC-RSA certificate
configurations with server info (currently used only for TLS extension of
certificate transparency) differently than until now. Specifically, the patches
are https://github.com/openssl/openssl/pull/914 and
https://github.com/openssl/openssl/pull/915.
They originated from research involving my Apache server configuration (on
Ubuntu 16.04) and Castaglia's coding of patches.
The Apache/OpenSSL bug is described fully here:
http://serverfault.com/questions/758482/apache-extension-error (the software I
used when I published this Serverfault thread was a bit older than now, but the
problem still persists in a different from: now instead of quitting the
connection OpenSSL accepts the connection but doesn't send ServerInfo data). In
particular, see the comment of Castaglia on their answer to the thread for
possible new Apache idea of implementation.
Maybe the following would be a good approach: After the first
certificate-private key pair, accept a ServerInfo Openssl configuration
directive which would call SSL_CTX_use_serverinfo_file for that certificate.
Then the configuration goes on with the second certificate-private key pair and
after that, the second serverinfo file location via Openssl configuration
directive (if applicable, that is if the server has dual certificate
configuration). So, Apache would need to process each pair and then, if it
finds directly below it a serverinfo, call SSL_CTX_use_serverinfo_file for THAT
certificate. When a new certificate-key pair is registered, the
SSL_CTX_use_serverinfo_file would be called again but for the last certificate
only.
There is no error logged on any Apache log file.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 59438] ServerInfo Extension 18 Missing for dual EC-RSA
certificate configurations
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=59438
Jason Milionis <ja...@hotmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |WORKSFORME
--- Comment #4 from Jason Milionis <ja...@hotmail.com> ---
Great, Yann, this worked like a charm.
However, I am curious: When using the above mentioned command "openssl s_client
-CApath /etc/ssl/certs -cipher DHE-RSA-AES256-SHA -serverinfo 18 -connect
winpack.eu.org:443" after displaying ServerInfo extension OpenSSL hangs for
about 0.75 seconds and then displays other info, whereas when using ECDSA
(without the -cipher DHE-RSA-AES256-SHA) everything is displaying without the
intermittent 0.75-second lag.
So, maybe document that for dual EC/RSA certificate configurations the
SSLOpenSSLConfCmd should be used exclusively?
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 59438] ServerInfo Extension 18 Missing for dual EC-RSA
certificate configurations
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=59438
--- Comment #3 from Yann Ylavic <yl...@gmail.com> ---
The issue seems to be that SSLOpenSSLConfCmd and
SSLCertificateFile/SSLCertificateKeyFile don't mix well with each other.
Could you try to use exclusively SSLOpenSSLConfCmd to configure your
certificate(s) file/key/info/dhparams?
Something like:
SSLOpenSSLConfCmd Certificate /path/to/server/cert/file
SSLOpenSSLConfCmd PrivateKey /path/to/server/cert/key
SSLOpenSSLConfCmd ServerInfoFile /path/to/server/info/file
SSLOpenSSLConfCmd DHParameters /path/to/dh/params/file (if any)
repeated for every certificate/info/dhparams you need to configure, and see if
it works?
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 59438] ServerInfo Extension 18 Missing for dual EC-RSA
certificate configurations
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=59438
Jason Milionis <ja...@hotmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Priority|P3 |P4
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 59438] ServerInfo Extension 18 Missing for dual EC-RSA
certificate configurations
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=59438
--- Comment #2 from Jason Milionis <ja...@hotmail.com> ---
Detailed OpenSSL session when this fails:
Command: "openssl s_client -CApath /etc/ssl/certs -cipher DHE-RSA-AES256-SHA
-serverinfo 18 -connect winpack.eu.org:443"
Output:
CONNECTED(00000003)
depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
verify return:1
depth=0 CN = winpack.cf
verify return:1
---
Certificate chain
0 s:/CN=winpack.cf
i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
1 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
i:/O=Digital Signature Trust Co./CN=DST Root CA X3
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIGmzCCBYOgAwIBAgISA3XRpPHxuH1gqdOpHtPHPmzMMA0GCSqGSIb3DQEBCwUA
MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD
ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMzAeFw0xNjAzMjUxOTU3MDBaFw0x
NjA2MjMxOTU3MDBaMBUxEzARBgNVBAMTCndpbnBhY2suY2YwggIiMA0GCSqGSIb3
DQEBAQUAA4ICDwAwggIKAoICAQCn/fciS4Z+YPTHtkNrWjTj1Bv222hBw6zBtbGz
t20cC64rACNfUjYCNDfgmhIo/lbhi23Kow7Maah74riLY0Dlr2iFELAUD2w+V2z6
acusjpVYKidubwrFT8Re5L6MzSq0BXEzcxIx4FWVBlfaYguGpMZqjOLhbxQgHFHZ
sVp2/dtxLrB5C2iUlU5v4mcoMR4hCc9/WHgqi5tqSUT8G/XNzwXe8kj3iJ5WL6bL
xy0MYfi7Lq5KIHsfu7RZiJuPoqia6H3PhKLqDylcch/+40IPk8wCEZvDACDh2tX0
XGYmGKjVzli/P62H0hepn9cKiMoxck6Uk+YZiZWEKllldzbuNpTaZyEF939NJ6Ga
/rHnVqIHetUKJhuRu5Ph+OMOPGUyzPt57G4TNTKGrpwvdTUvmliZmfCXZEi3XnJm
o+ULsxM6ByF+mMMOGiVJ7K0sv1KW9k8clK1zqCc6ZKz8wivPL9/YLYVCplS7vzCK
HFqGF6t6YbM7VoCvkKCeK5gro2V8M4ggGo5YxQogg2SHVqg8ZEHFt4nIYJdBf9Hu
GTNP/yiOkysSys+g3bKQ+2kkZatYtcw61G75adml4DyPt5t83T2mlcCXgxwRdz19
D25vLlTiH1jCdM7x9b/j+WGMbWDfDTCfSNlNW5Myv8gI7uI54Kr/yJ3YMvu8gl07
pmNJRQIDAQABo4ICrjCCAqowDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsG
AQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBTQ50MGPlk7
Mq2jmYluZCmYgee7ijAfBgNVHSMEGDAWgBSoSmpjBH3duubRObemRWXv86jsoTBw
BggrBgEFBQcBAQRkMGIwLwYIKwYBBQUHMAGGI2h0dHA6Ly9vY3NwLmludC14My5s
ZXRzZW5jcnlwdC5vcmcvMC8GCCsGAQUFBzAChiNodHRwOi8vY2VydC5pbnQteDMu
bGV0c2VuY3J5cHQub3JnLzCBtwYDVR0RBIGvMIGsgg9tYWlsLndpbnBhY2suY2aC
E21haWwud2lucGFjay5ldS5vcmeCDW14LndpbnBhY2suY2aCEW14LndpbnBhY2su
ZXUub3Jngg5teDIud2lucGFjay5jZoISbXgyLndpbnBhY2suZXUub3Jnggp3aW5w
YWNrLmNmgg53aW5wYWNrLmV1Lm9yZ4IOd3d3LndpbnBhY2suY2aCEnd3dy53aW5w
YWNrLmV1Lm9yZzCB/gYDVR0gBIH2MIHzMAgGBmeBDAECATCB5gYLKwYBBAGC3xMB
AQEwgdYwJgYIKwYBBQUHAgEWGmh0dHA6Ly9jcHMubGV0c2VuY3J5cHQub3JnMIGr
BggrBgEFBQcCAjCBngyBm1RoaXMgQ2VydGlmaWNhdGUgbWF5IG9ubHkgYmUgcmVs
aWVkIHVwb24gYnkgUmVseWluZyBQYXJ0aWVzIGFuZCBvbmx5IGluIGFjY29yZGFu
Y2Ugd2l0aCB0aGUgQ2VydGlmaWNhdGUgUG9saWN5IGZvdW5kIGF0IGh0dHBzOi8v
bGV0c2VuY3J5cHQub3JnL3JlcG9zaXRvcnkvMA0GCSqGSIb3DQEBCwUAA4IBAQAa
WVAFmNQaKw9ZDTuz0tW9ZadB0cO6ufLtC7J6THERQhtGcisgtRQdRgrlNOTdvkyL
Gi5zoqoSiz0AyMWsyB5f7ZoFDiB3ZGJ/Z1nGELmRpVVbUVsZqOEIrf1hb9tgV0IE
o+uCBMZJBRlLzeKvWLkoruOScEY+3W8SQHUKc1FHsOxAEhjuM2xx6XrbfT6BlvaO
FtZzhgbTvVRZ4g2eC/W2bEhy7erHpFTbFukRwjfKiE5BF+gwpyy8S/2mS3pR8klG
ZoDUcnMJLOqsc97L2mhnjKyW360cIsu4n/Rpd3CCw3lTLLZ9XVae8PjjSzDo2Nc/
bIl/ANOzNDUJr+JRGUiw
-----END CERTIFICATE-----
subject=/CN=winpack.cf
issuer=/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: DH, 4096 bits
---
SSL handshake has read 4797 bytes and written 701 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : DHE-RSA-AES256-SHA
Session-ID:
B1796305C99DC2086C9AEBAD8CD1C8F7A0F1E5DC06D940E8B40E4C349D2E268C
Session-ID-ctx:
Master-Key:
5A06BEEB42CA60AEA80CABFEBED2E1D3301E6979C5851CF3BFC0DA654E2EDEEA023918E8E254F0E8B119F7101CDF31F0
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
(info truncated by me)
Start Time: 1462704766
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
(note that there is no serverinfo tls extension here)
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 59438] ServerInfo Extension 18 Missing for dual EC-RSA
certificate configurations
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=59438
--- Comment #1 from Jason Milionis <ja...@hotmail.com> ---
*in a different form
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org