<div dir="ltr"><br><br><div class="gmail_quote"><div dir="ltr">On Thu, Jul 23, 2015 at 2:29 PM Eric Meadows-Jönsson <<a href="mailto:eric.meadows.jonsson@gmail.com">eric.meadows.jonsson@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><a href="https://api.twilio.com/2010-04-01/Accounts/" style="font-size:12.8000001907349px" target="_blank">https://api.twilio.com/2010-04-01/Accounts/</a> works for me with Hex's http client. <a href="https://api.gateway.evercam.io/v1" style="font-size:12.8000001907349px" target="_blank">https://api.gateway.evercam.io/v1</a> doesn't work and the issue seems to be that they only send their own certificate without any intermediate certificates in the chain. Since `partial_chain` is supposed to claim trust for an intermediate certificate (and only for an intermediate in the provided chain, you cannot return your own intermediate from the CA store) this is impossible to do.<br></div></blockquote><div><br></div><span style="font-size:13px;line-height:19px">I did a minimal case there to test:</span><div style="font-size:13px;line-height:19px"><span style="line-height:1.5"><a href="https://github.com/benoitc/test_ssl">https://github.com/benoitc/test_ssl</a></span><br></div><div style="font-size:13px;line-height:19px"><span style="line-height:1.5"><br></span></div><div style="font-size:13px;line-height:19px"><span style="line-height:1.5">So indeed I confirm the first url "</span><a href="https://api.twilio.com/2010-04-01/Accounts/" target="_blank" style="line-height:20px;font-size:12.8000001907349px">https://api.twilio.com/2010-04-01/Accounts/</a><span style="line-height:20px;font-size:small"> " is working. But not the second one. </span></div><div style="font-size:13px;line-height:19px"><br></div><div>not sure now why it's not working in hackney now :/</div><div><br></div><div>But the interresting thing is that curl is returning different results:</div><div><br></div><div><div> [test_ssl] curl --cacert priv/ca-bundle.crt <a href="https://api.twilio.com/2010-04-01/Accounts/">https://api.twilio.com/2010-04-01/Accounts/</a></div><div> curl: (51) SSL: certificate verification failed (result: 5)</div><div><br></div><div> [test_ssl] curl --cacert priv/ca-bundle.crt <a href="https://api.gateway.evercam.io/v1">https://api.gateway.evercam.io/v1</a></div><div> <!DOCTYPE html></div><div> <html></div><div> ....</div></div><div><br></div><div>Probably because curl on osx is using keychain though. I will check for the intermediate certificates.</div><div><br></div><div>- benoit</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jul 23, 2015 at 12:11 PM, Benoit Chesneau <span dir="ltr"><<a href="mailto:bchesneau@gmail.com" target="_blank">bchesneau@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><br><br><div class="gmail_quote"><span><div dir="ltr">On Thu, Jul 23, 2015 at 3:27 AM Tristan Sloughter <<a href="mailto:t@crashfast.com" target="_blank">t@crashfast.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><u></u>
<div><div>For Erlang code I copied from Eric to implement the same for rebar3's hex client :)<br></div>
<div> </div>
<div><a href="https://github.com/rebar/rebar3/blob/master/src/rebar_pkg_resource.erl#L127-L172" target="_blank">https://github.com/rebar/rebar3/blob/master/src/rebar_pkg_resource.erl#L127-L172</a><br></div>
<div> </div>
<div>and<br></div>
<div> </div>
<div><a href="https://github.com/rebar/rebar3/blob/master/src/rebar_cacerts.erl" target="_blank">https://github.com/rebar/rebar3/blob/master/src/rebar_cacerts.erl</a><br></div>
<div> </div>
<div><div>--<br></div>
<div>Tristan Sloughter<br></div>
<div><a href="mailto:t@crashfast.com" target="_blank">t@crashfast.com</a><br></div>
<div> </div></div></div></blockquote><div><br></div></span><div>Hrmm Are you sure it is actually working?</div><div><br></div><div>I tried similar code in hackney on the following URLS:</div><div><br></div><div><a href="https://api.gateway.evercam.io/v1" target="_blank">https://api.gateway.evercam.io/v1</a></div><div><a href="https://api.twilio.com/2010-04-01/Accounts/" target="_blank">https://api.twilio.com/2010-04-01/Accounts/</a></div><div><br></div><div>And I get an "unkown_ca" error...</div><div><br></div><div>Hackney changes are:</div><div><a href="https://github.com/benoitc/hackney/pull/217" target="_blank">https://github.com/benoitc/hackney/pull/217</a><br></div><div><br></div><div>On which URLS did you tested it? How do you generate your CA file?</div><span><font color="#888888"><div><br></div><div>- benoit</div></font></span><div><div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div>
</div></div><div>
<div> </div>
<div> </div>
<div>On Wed, Jul 22, 2015, at 08:15 PM, Eric Meadows-Jönsson wrote:<br></div>
<blockquote type="cite"><div dir="ltr"><div>I maintain a http client using httpc as part of the Hex package manager and have been trying to do proper HTTPS connections with it. In my experience there is a lot of things you have to implement yourself if you want to do it correctly and I have had many of the same questions you have. Many things are still not clear for me but hopefully I can answer some of your questions. I am going to be linking to Elixir code but I think it will be easy for an Erlang programmer to understand it.<br></div>
<div> </div>
<div>These are the SSL options I use: <a href="https://github.com/hexpm/hex/blob/98ebb655a3e4b494795f510c07e6b16f16650e91/lib/hex/api.ex#L54-L55" target="_blank">https://github.com/hexpm/hex/blob/98ebb655a3e4b494795f510c07e6b16f16650e91/lib/hex/api.ex#L54-L55</a>.<br></div>
<div> </div>
<div>Interesting options are `verify_fun`, Erlang doesn't seem to support hostname verification so I use an Elixir port of <a href="https://github.com/deadtrickster/ssl_verify_hostname.erl" target="_blank">https://github.com/deadtrickster/ssl_verify_hostname.erl</a> for that, many thanks to Ilya Khaprov for creating that library. I pass in a CA certificate store via `cacerts`, it is generated from Mozilla's store with curl's mk-ca-bundle tool <a href="http://curl.haxx.se/docs/mk-ca-bundle.html" target="_blank">http://curl.haxx.se/docs/mk-ca-bundle.html</a>, you can see how it is called here: <a href="https://github.com/hexpm/hex/blob/98ebb655a3e4b494795f510c07e6b16f16650e91/mix.exs#L61-L84" target="_blank">https://github.com/hexpm/hex/blob/98ebb655a3e4b494795f510c07e6b16f16650e91/mix.exs#L61-L84</a>.<br></div>
<div> </div>
<div>Finally, unless you implement the `partial_chain` function many websites wont work because they do not send a complete certificate chain. Disclaimer: I do not know the correct (and secure) way to implement this function, I even received a security bug report recently <a href="https://github.com/hexpm/hex/issues/108" target="_blank">https://github.com/hexpm/hex/issues/108</a> because the old implementation was even more wrong. As you can see from the linked issue we are still not confident that this is a correct implementation. Reviews of this function from the OTP team or someone intimate with Erlang SSL would be very much appreciated.<br></div>
<div> </div>
<div><div>There are also the new options for SNI in OTP 18 which I have not implemented yet.<br></div>
<div> </div>
<div>As you can tell there is a lot of code you have to write yourself and Erlang's ssl application does not have very exhaustive documentation or any guides at all AFAICT, so it is very hard to implement this without any bugs exposing security holes and I am not very confident in my own code because of this.<br></div>
</div>
</div>
<div><div> </div>
<div><div>On Thu, Jul 23, 2015 at 2:28 AM, Kaiduan Xie <span dir="ltr"><<a href="mailto:kaiduanx@gmail.com" target="_blank">kaiduanx@gmail.com</a>></span> wrote:<br></div>
<blockquote style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div>The following articles explain thing very clearly,<br></div>
<div> </div>
<div> <a href="http://security.stackexchange.com/questions/59566/ssl-certificate-chain-verification" target="_blank">http://security.stackexchange.com/questions/59566/ssl-certificate-chain-verification</a><br></div>
<div> </div>
<div> <a href="http://security.stackexchange.com/questions/56389/ssl-certificate-framework-101-how-does-the-browser-actually-verify-the-validity" target="_blank">http://security.stackexchange.com/questions/56389/ssl-certificate-framework-101-how-does-the-browser-actually-verify-the-validity</a><br></div>
<div> <span><span style="color:rgb(136,136,136)"><br>
/Kaiduan<br></span></span></div>
<div><div><div> </div>
<div>
On Wed, Jul 22, 2015 at 7:35 PM, Geoff Cant <<a href="mailto:nem@erlang.geek.nz" target="_blank">nem@erlang.geek.nz</a>> wrote:<br></div>
<div>
> Hi all, I’m wondering if anyone has written a guide (or can link to example code) showing how they use OTP’s SSL library to connect to arbitrary TLS servers on the internet with x.509 cert chain validation.<br></div>
<div>
><br></div>
<div>
> I know the default SSL library option is ‘verify_none’, and that there is a ‘cacertfile’ option, but a) it’s 2015 and you should verify cert chains, and b) are people really bundling all the standard public CA certs into a single giant cacertfile? If you are bundling say all of ubuntu’s /etc/certs, do you have any tooling for this (cat /etc/certs/*.pem >> get_me_everyone.cacerts)? Am I missing something and OTP automatically uses the contents of /etc/certs ?<br></div>
<div>
><br></div>
<div>
> Also, are people writing utility libraries/code to wrap ssl:* in order to setup the connect/listen options they use? (I know I wrote one to do certificate pinning)<br></div>
<div>
><br></div>
<div>
><br></div>
<div>
> I’m generally curious about your OTP ssl client use - particularly around cert chain validation.<br></div>
<div>
><br></div>
<div>
> Cheers,<br></div>
<div>
> -Geoff<br></div>
<div>
> _______________________________________________<br></div>
<div>
> erlang-questions mailing list<br></div>
<div>
> <a href="mailto:erlang-questions@erlang.org" target="_blank">erlang-questions@erlang.org</a><br></div>
<div>
> <a href="http://erlang.org/mailman/listinfo/erlang-questions" target="_blank">http://erlang.org/mailman/listinfo/erlang-questions</a><br></div>
<div>
_______________________________________________<br></div>
<div>
erlang-questions mailing list<br></div>
<div> <a href="mailto:erlang-questions@erlang.org" target="_blank">erlang-questions@erlang.org</a><br></div>
<div> <a href="http://erlang.org/mailman/listinfo/erlang-questions" target="_blank">http://erlang.org/mailman/listinfo/erlang-questions</a><br></div>
</div>
</div>
</blockquote></div>
<div> </div>
<div> </div>
<div> </div>
<div>-- <br></div>
<div>Eric Meadows-Jönsson<br></div>
</div>
<div><u>_______________________________________________</u><br></div>
<div>erlang-questions mailing list<br></div>
<div><a href="mailto:erlang-questions@erlang.org" target="_blank">erlang-questions@erlang.org</a><br></div>
<div><a href="http://erlang.org/mailman/listinfo/erlang-questions" target="_blank">http://erlang.org/mailman/listinfo/erlang-questions</a><br></div>
</blockquote><div> </div>
</div>
_______________________________________________<br>
erlang-questions mailing list<br>
<a href="mailto:erlang-questions@erlang.org" target="_blank">erlang-questions@erlang.org</a><br>
<a href="http://erlang.org/mailman/listinfo/erlang-questions" rel="noreferrer" target="_blank">http://erlang.org/mailman/listinfo/erlang-questions</a><br>
</blockquote></div></div></div></div>
<br>_______________________________________________<br>
erlang-questions mailing list<br>
<a href="mailto:erlang-questions@erlang.org" target="_blank">erlang-questions@erlang.org</a><br>
<a href="http://erlang.org/mailman/listinfo/erlang-questions" rel="noreferrer" target="_blank">http://erlang.org/mailman/listinfo/erlang-questions</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div>Eric Meadows-Jönsson</div>
</div>
</blockquote></div></div>