search

chuckremes / ffi-rzmq

FFI bindings for ZeroMQ so the library can be used under JRuby and other FFI-compliant ruby runtimes
242 stars 62 forks source link

please update keys/certificate to higher standards #131

Closed boutil closed 5 years ago

boutil commented 5 years ago

In Debian with openssl 1.1, test using SSL socket fails because the key is too small:

| 
|   1) ZMQ::Poller poll works with SSLSocket
|      Failure/Error: server = OpenSSL::SSL::SSLSocket.new(s, ctx)
| 
|      OpenSSL::SSL::SSLError:
|        SSL_CTX_use_certificate: ee key too small
|      # ./spec/poll_spec.rb:254:in `initialize'
|      # ./spec/poll_spec.rb:254:in `new'
|      # ./spec/poll_spec.rb:254:in `block (3 levels) in <module:ZMQ>'
| 
| Finished in 2.72 seconds (files took 0.12738 seconds to load)
| 443 examples, 1 failure
| 
| Failed examples:
| 
| rspec ./spec/poll_spec.rb:240 # ZMQ::Poller poll works with SSLSocket

For details, see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=912236 I could make tests pass by regenerating a 4096 bit RSA key and a certificate. Could you please update the key to higher standards and the certificate, and possibly provide the exact commands used to generate them in a helper script in the repository. Thanks a lot!

chuckremes commented 5 years ago

I'll take a look at this in a few days. Thanks for the report.

chuckremes commented 5 years ago

@boutil Please update to ffi-rzmq version 2.0.7 where this is fixed. And thanks for contributing the helper script to update the cert & key going forward.