如何解决带有 ECDSA 证书的 TLS握手失败,因为没有共享密码
我一直在使用自生成的 RSA 证书颁发机构来签署我的服务器证书,到目前为止一切正常。
遵循相同的模式,我尝试使用 ECDSA 签名,假设较小的密钥大小可能会使 IOT 设备更容易。 不幸的是,我无法获得“工作”证书..
使用 openssl(OpenSSL 1.1.0l 2019 年 9 月 10 日)测试证书时,我收到一条错误消息(在服务器上)说“tls_post_process_client_hello:no shared cipher”
服务器端:
openssl s_server -accept 1443 -www -key ec_server_key.pem -cert ec_server_cert.pem
Using default temp DH parameters
ACCEPT
140203753312320:error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher:../ssl/statem/statem_srvr.c:1419:
客户端:
openssl s_client -showcerts -connect localhost:1443 -CAfile ec_ca.pem
CONNECTED(00000003)
139868026671168:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:../ssl/record/rec_layer_s3.c:1407:SSL alert number 40
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 176 bytes
Verification: OK
---
New,(NONE),Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : 0000
Session-ID:
Session-ID-ctx:
Master-Key:
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1618487596
Timeout : 7200 (sec)
Verify return code: 0 (ok)
Extended master secret: no
---
使用 RSA 签名一切正常
这就是我使用 RSA 生成证书的方式
#!/bin/bash
# CERTIFICATE AUTHORITY
# generate CA private key
openssl genrsa -aes256 -passout pass:password -out rsa_ca_key.pem 4096
# generate CA public key
openssl req -new -x509 -sha256 -passin pass:password -days 365 -subj "/C=CO/ST=State/L=City/O=Organization/CN=AuthorityName" -key rsa_ca_key.pem -out rsa_ca.pem
# FOR EACH SERVER
# generate server private key
openssl genrsa -out rsa_server_key.pem 4096
# generate server certificate
openssl req -new -sha256 -subj "/CN=server_name" -key rsa_server_key.pem -out rsa_server.csr
# generate extension
echo subjectAltName = DNS:server_domain,IP:10.10.10.20,IP:127.0.0.1 > extfile.cnf
# sign the server certificate
openssl x509 -req -sha256 -days 365 -in rsa_server.csr -CA rsa_ca.pem -CAkey rsa_ca_key.pem -CAcreateserial -out rsa_server_cert.pem -extfile extfile.cnf -passin pass:password
# clean up
rm extfile.cnf rsa_server.csr
这就是我使用 ECDSA 生成证书的方式
#!/bin/bash
# CERTIFICATE AUTHORITY
# generate CA private key
openssl ecparam -genkey -name secp256k1 -param_enc explicit | openssl ec -aes256 -passout pass:password -out ec_ca_key.pem
# generate CA public key
openssl req -new -x509 -sha256 -passin pass:password -days 365 -subj "/C=CO/ST=State/L=City/O=Organization/CN=AuthorityName" -key ec_ca_key.pem -out ec_ca.pem
# FOR EACH SERVER
# generate server private key
openssl ecparam -name secp256k1 -genkey -param_enc explicit -out ec_server_key.pem
# generate server certificate
openssl req -new -sha256 -subj "/CN=server_name" -key ec_server_key.pem -out ec_server.csr
# generate extension
echo subjectAltName = DNS:server_domain,IP:127.0.0.1 > extfile.cnf
# sign the server certificate
openssl x509 -req -sha256 -days 365 -in ec_server.csr -CA ec_ca.pem -CAkey ec_ca_key.pem -CAcreateserial -out ec_server_cert.pem -extfile extfile.cnf -passin pass:password
# clean up
rm extfile.cnf ec_server.csr
解决方法
请在服务器端和客户端添加TLS版本和专用曲线,如下所示。
- openssl s_server -accept 1443 -www -key ec_server_key.pem -cert ec_server_cert.pem -tls1_2 -curves secp256k1
- openssl s_client -showcerts -connect localhost:1443 -CAfile ec_ca.pem -tls1_2 -curves secp256k1
版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 dio@foxmail.com 举报,一经查实,本站将立刻删除。