<div dir="ltr"><div><div><div><div><div><div><div>Hi!<br><br></div>Thank you for the example, I will try to reproduce the problem and fix it. A workaround is to specify<br></div>the cipher suites to: <br><br>{ciphers, [{dhe_rsa,aes_256_cbc,sha256},<br>
{dhe_dss,aes_256_cbc,sha256},<br> {rsa,aes_256_cbc,sha256},<br> {dhe_rsa,aes_128_cbc,sha256},<br> {dhe_dss,aes_128_cbc,sha256},<br> {rsa,aes_128_cbc,sha256},<br> {dhe_rsa,aes_256_cbc,sha},<br> {dhe_dss,aes_256_cbc,sha},<br>
{rsa,aes_256_cbc,sha},<br> {dhe_rsa,'3des_ede_cbc',sha},<br> {dhe_dss,'3des_ede_cbc',sha},<br> {rsa,'3des_ede_cbc',sha},<br> {dhe_rsa,aes_128_cbc,sha},<br> {dhe_dss,aes_128_cbc,sha},<br> {rsa,aes_128_cbc,sha},<br>
{rsa,rc4_128,sha},<br> {rsa,rc4_128,md5},<br> {dhe_rsa,des_cbc,sha},<br> {rsa,des_cbc,sha}]}<br><br></div>so that elliptic-curve ciphers will not be negotiated. The elliptic curve support in R16B01 is limited to<br></div>
named elliptic curves and, the TODO spotted seems like a likely candidate for the problem, I am so sorry<br></div>we missed that when integrating the Elliptic curve contribution. Anyhow maybe the fix will be supporting all<br>
</div>type of curves instead of doing the "TODO" I do not think there is so much work left to do that.<br><br></div>Regards Ingela Erlang/OTP team - Ericsson AB <br><div><div><div><div><div><br><br></div></div>
</div></div></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">2013/6/23 Andrew Shu <span dir="ltr"><<a href="mailto:talklittle@gmail.com" target="_blank">talklittle@gmail.com</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>THANK YOU for posting this! This being my first time using Cowboy HTTPS and secure websockets, I was going crazy trying to figure out why SSL wasn't working via Chromium on Linux, while curl seemed to handle the self-signed certificates okay. It wouldn't have occurred to me that it could be an Erlang bug.</div>
<div><br></div><div>After reverting to R16B, and removing all traces of R16B01, everything seems working.</div><div>I wasted a lot of time swapping out SSL certificates to no avail. I think sticking with R16B is the best, or only, solution for now.<br>
</div><div><br></div><div>I had been getting a Chromium gray error screen with "ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED". Not the usual "this certificate is not trusted" red screen.</div><div>Firefox choked too. Curl seemed ok, strangely enough.</div>
<div><br></div><div>Erlang shell was printing "SSL: certify: tls_connection.erl:2275:Fatal error: unknown ca" with some certificates. Swapping certs may have removed the error sometimes (I wasn't checking this carefully), but the Chromium error remained. A real CA-signed cert didn't help.</div>
<div><br></div><div>This was happening even with the Cowboy SSL example at <a href="https://github.com/extend/cowboy/tree/master/examples/ssl_hello_world" target="_blank">https://github.com/extend/cowboy/tree/master/examples/ssl_hello_world</a></div>
<div><br></div><div>Again, thanks for indicating that this is an Erlang regression. R16B seems to work fine compared to R16B01.</div><div class="HOEnZb"><div class="h5"><div><br></div><br>On Friday, June 21, 2013 11:44:34 AM UTC-4, Ransom Richardson wrote:<blockquote class="gmail_quote" style="margin:0;margin-left:0.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">
<div name="divtagdefaultwrapper" style="font-size:12pt;margin:0;font-family:Calibri,Arial,Helvetica,sans-serif">
<div name="divtagdefaultwrapper" style="font-size:12pt;margin:0;font-family:Calibri,Arial,Helvetica,sans-serif">
Not sure if this is a known issue but I didn't see anything about it when I searched.</div>
<div name="divtagdefaultwrapper" style="font-size:12pt;margin:0;font-family:Calibri,Arial,Helvetica,sans-serif">
<br>
</div>
<div name="divtagdefaultwrapper" style="margin:0px"><font size="3">After upgrading to R16B01 our iPhone client can no longer connect to the service over SSL. The same build works fine when deployed on a machine running R16B.</font>
<div style="font-size:12pt;font-family:Calibri,Arial,Helvetica,sans-serif">
<br>
</div>
<div style="font-size:12pt;font-family:Calibri,Arial,Helvetica,sans-serif">
If we specify</div>
<div style="font-size:12pt;font-family:Calibri,Arial,Helvetica,sans-serif">
<div><br>
</div>
<div>{ciphers, [{rsa,aes_256_cbc,sha256}]},</div>
</div>
<div style="font-size:12pt;font-family:Calibri,Arial,Helvetica,sans-serif">
<br>
</div>
<div style="font-size:12pt;font-family:Calibri,Arial,Helvetica,sans-serif">
then it is able to connect successfully </div>
<div style="font-size:12pt;font-family:Calibri,Arial,Helvetica,sans-serif">
<br>
</div>
<div style="font-size:12pt;font-family:Calibri,Arial,Helvetica,sans-serif">
However, if we specify:</div>
<div><br>
</div>
<div>{ciphers, [{rsa,aes_256_cbc,sha256}, {ecdhe_rsa,aes_256_cbc,sha}]},</div>
<div style="font-size:12pt;font-family:Calibri,Arial,Helvetica,sans-serif">
<br>
</div>
<div style="font-size:12pt;font-family:Calibri,Arial,Helvetica,sans-serif">
then the connection fails.</div>
<div style="font-size:12pt;font-family:Calibri,Arial,Helvetica,sans-serif">
<br>
</div>
<div style="font-size:12pt;font-family:Calibri,Arial,Helvetica,sans-serif">
I didn't debug further, but did notice this following in tls_handshake.erl, which seems like it might be related:</div>
<div style="font-size:12pt;font-family:Calibri,Arial,Helvetica,sans-serif">
<br>
</div>
<div>
<div><span style="white-space:pre-wrap"></span> %% TODO: need to take supported Curves into Account when selecting the CipherSuite....</div>
<div><span style="white-space:pre-wrap"></span> %% if whe have an ECDSA cert with an unsupported curve, we need to drop ECDSA ciphers</div>
<div style="font-size:12pt;font-family:Calibri,Arial,Helvetica,sans-serif">
<br>
</div>
</div>
</div>
</div>
</div>
</blockquote></div></div><br>_______________________________________________<br>
erlang-questions mailing list<br>
<a href="mailto:erlang-questions@erlang.org">erlang-questions@erlang.org</a><br>
<a href="http://erlang.org/mailman/listinfo/erlang-questions" target="_blank">http://erlang.org/mailman/listinfo/erlang-questions</a><br>
<br></blockquote></div><br></div>