DaveCTurner
commented
8 years ago We were bitten by this again recently so I've sent a PR.
A simple test program showing the problem:
import Data.Monoid
import Network.HTTP.Types.Status
import Network.TLS
import Network.TLS.Extra.Cipher
import Network.Wai
import Network.Wai.Handler.Warp
import Network.Wai.Handler.WarpTLS
import System.Environment
main :: IO ()
main = do
[certFile, keyFile] <- getArgs
runTLS
((tlsSettings certFile keyFile) {tlsCiphers = ciphersuite_strong})
(setPort 17167 defaultSettings)
(\_ respond -> respond $ responseBuilder status200 [] mempty)If this is pointed at a cert chain (of at least two certs) that you give to Apache or nginx then it fails with the error
no ciphers available with those parametersbut if the order of certs in the cert chain is reversed then it works as expected.
The attached PR makes things behave as expected.
Cheers,
Hi,
The function
readSignedObjectreverses the order of the objects read from the file. The order of objects is important (see e.g. http://tools.ietf.org/html/rfc4346#section-7.4.2) and this reversal is deeply surprising.Typically, certificate chains are stored in a file in order from leaf to root. For instance, nginx and Apache expect this ordering. Additionally, this is the order that a CertificateChain must be in e.g. the return value to onCertificateRequest.
Probably a duplicate of #31 which was closed due to lack of interest, but consider me interested now!
Cheers,
David