search

noxxi / p5-io-socket-ssl

IO::Socket::SSL Perl Module
36 stars 60 forks source link

Weird diagnostics for short RSA keys #89

Closed beldmit closed 4 years ago

beldmit commented 4 years ago

Openssl 1.1.1 does not treat 1024-bit RSA certificates as safe for clients authentification in SSL by default (@SECLEVEL=2) with diagnostics like

140510343623808:error:140AB18F:SSL routines:SSL_CTX_use_certificate:ee key too small:../ssl/ssl_rsa.c:310:

As IO::Socket::SSL tries to load a certificate as PEM, than DER, than PKCS12, when the original certificate is in PEM format, the diagnostics is smth about bad ASN.1 format instead of valid one.

package IO::Socket::SSL;

our $VERSION = '2.060';

noxxi commented 4 years ago

This is unfortunately not that easy to fix since it might fail for a variety of reasons. I've adjusted at least the error message to include more possible cases why it failed: 5f74d7f