<div dir="ltr">Hi!<br><div><div class="gmail_extra"><br><div class="gmail_quote">2015-07-17 11:31 GMT+02:00 Alex Hudich <span dir="ltr"><<a href="mailto:alttagil@gmail.com" target="_blank">alttagil@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div><div>But it seems to me thet there are some diffrernces between 17.4 and 17.5 which make 17.5 «more buggy» </div><div><br></div><div>I prepared two files. cacert.pem.1 is empty file with length 0 and cacert.pem which I’ve downloaded earlier. And there is an output of 17.5 which seems to me wrong. </div><div><br></div><div>Line 2 and 3 is ok. Line 4 is ok. But why line 5 gave me no error??</div><div><br></div><div><br></div><div><br></div><div><div style="margin:0px;font-family:Menlo"><font color="#008cb4">Erlang/OTP 17 [erts-6.4] [source] [64-bit] [async-threads:10] [hipe] [kernel-poll:false]</font></div><span class=""><div style="margin:0px;font-family:Menlo;min-height:21px"><font color="#008cb4"><br></font></div><div style="margin:0px;font-family:Menlo"><font color="#008cb4">Eshell V6.4 (abort with ^G)</font></div><div style="margin:0px;font-family:Menlo"><font color="#008cb4">1> application:ensure_all_started(ssl).</font></div><div style="margin:0px;font-family:Menlo"><font color="#008cb4">{ok,[crypto,asn1,public_key,ssl]}</font></div></span><div style="margin:0px;font-family:Menlo"><font color="#008cb4">2> ssl:connect( "<a href="http://www.nicemine.ru" target="_blank">www.nicemine.ru</a>", 443, [{verify,verify_peer},{server_name_indication,"<a href="http://www.nicemine.ru" target="_blank">www.nicemine.ru</a>"},{depth,2},{cacertfile,"cacert.pem.1"}] ).</font></div><div style="margin:0px;font-family:Menlo;min-height:21px"><font color="#008cb4"><br></font></div><div style="margin:0px;font-family:Menlo"><font color="#008cb4">=ERROR REPORT==== 17-Jul-2015::13:26:45 ===</font></div><div style="margin:0px;font-family:Menlo"><font color="#008cb4">SSL: certify: ssl_handshake.erl:1401:Fatal error: unknown ca</font></div><div style="margin:0px;font-family:Menlo"><font color="#008cb4">{error,{tls_alert,"unknown ca"}}</font></div><div style="margin:0px;font-family:Menlo"><font color="#008cb4">3> ssl:connect( "<a href="http://www.nicemine.ru" target="_blank">www.nicemine.ru</a>", 443, [{verify,verify_peer},{server_name_indication,"<a href="http://www.nicemine.ru" target="_blank">www.nicemine.ru</a>"},{depth,2},{cacertfile,"cacert.pem.1"}] ).</font></div><div style="margin:0px;font-family:Menlo;min-height:21px"><font color="#008cb4"><br></font></div><div style="margin:0px;font-family:Menlo"><font color="#008cb4">=ERROR REPORT==== 17-Jul-2015::13:26:48 ===</font></div><div style="margin:0px;font-family:Menlo"><font color="#008cb4">SSL: certify: ssl_handshake.erl:1401:Fatal error: unknown ca</font></div><div style="margin:0px;font-family:Menlo"><font color="#008cb4">{error,{tls_alert,"unknown ca"}}</font></div><div style="margin:0px;font-family:Menlo"><font color="#008cb4">4> ssl:connect( "<a href="http://www.nicemine.ru" target="_blank">www.nicemine.ru</a>", 443, [{verify,verify_peer},{server_name_indication,"<a href="http://www.nicemine.ru" target="_blank">www.nicemine.ru</a>"},{depth,2},{cacertfile,"cacert.pem"}] ). </font></div><div style="margin:0px;font-family:Menlo"><font color="#008cb4">{ok,{sslsocket,{gen_tcp,#Port<0.1236>,tls_connection,</font></div><div style="margin:0px;font-family:Menlo"><font color="#008cb4"> undefined},</font></div><div style="margin:0px;font-family:Menlo"><font color="#008cb4"> <0.53.0>}}</font></div><div style="margin:0px;font-family:Menlo"><font color="#008cb4">5> ssl:connect( "<a href="http://www.nicemine.ru" target="_blank">www.nicemine.ru</a>", 443, [{verify,verify_peer},{server_name_indication,"<a href="http://www.nicemine.ru" target="_blank">www.nicemine.ru</a>"},{depth,2},{cacertfile,"cacert.pem.1"}] ).</font></div><div style="margin:0px;font-family:Menlo"><font color="#008cb4">{ok,{sslsocket,{gen_tcp,#Port<0.1243>,tls_connection,</font></div><div style="margin:0px;font-family:Menlo"><font color="#008cb4"> undefined},</font></div><div style="margin:0px;font-family:Menlo"><font color="#008cb4"> <0.55.0>}}</font></div></div></div><div style="margin:0px;font-family:Menlo"><font color="#008cb4"><br></font></div></div></blockquote><div><br><br></div><div>This is because the SSL/TLS-session established in 4 is reused to preform a abbreviated handshake where the chain is not checked.<br><br><br><br></div><div>Regards Ingela Erlang/OTP team - Ericsson AB<br></div><div><br><br> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div style="margin:0px;font-family:Menlo"><font color="#008cb4"></font></div><div><blockquote type="cite"><span class=""><div>16 июля 2015 г., в 21:16, Santiago Fernández <<a href="mailto:santif@gmail.com" target="_blank">santif@gmail.com</a>> написал(а):</div><br></span><div><div class="h5"><div><div dir="ltr">can't reproduce:<br><br>Erlang/OTP 17 [erts-6.4] [source] [64-bit] [smp:8:8] [async-threads:10] [kernel-poll:false]<br><br>Eshell V6.4 (abort with ^G)<br>1> application:ensure_all_started(ssl).<br>{ok,[crypto,asn1,public_key,ssl]}<br>2> ssl:connect( "<a href="http://www.nicemine.ru/" target="_blank">www.nicemine.ru</a>", 443, [{verify,verify_peer},{server_name_indication,"<a href="http://www.nicemine.ru/" target="_blank">www.nicemine.ru</a>"},{depth,2},{cacertfile,"cacert.pem"}] ).<br>{ok,{sslsocket,{gen_tcp,#Port<0.821>,tls_connection,<br> undefined},<br> <0.49.0>}}<br><br><br><br></div><div class="gmail_extra"><br clear="all"><div><div><div><br></div>--<div>Santiago</div></div></div>
<br><div class="gmail_quote">On Thu, Jul 16, 2015 at 2:54 PM, Alex Hudich <span dir="ltr"><<a href="mailto:alttagil@gmail.com" target="_blank">alttagil@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div>Hi,</div><div><br></div><div>It doesn’t help. Still <span style="font-family:Menlo;font-size:18px">{bad_cert,invalid_issuer}</span></div><div><span style="font-family:Menlo;font-size:18px"><br></span></div><div><span style="font-family:Menlo;font-size:18px"><br></span></div><br><div><blockquote type="cite"><div>16 июля 2015 г., в 20:29, Éric Pailleau <<a href="mailto:eric.pailleau@wanadoo.fr" target="_blank">eric.pailleau@wanadoo.fr</a>> написал(а):</div><div><div><br><div>Hi, try with depth = 3. Depth 0 to depth 2 is 3.<br>Regards<br><br>Le 16 juil. 2015 15:15, Alex Hudich <<a href="mailto:alttagil@gmail.com" target="_blank">alttagil@gmail.com</a>> a écrit :<br><blockquote type="cite"><br>When I tried to check connection with openssl command I’ve got w/o cacert.pem file:<br><br>$ openssl s_client -connect <a href="http://nicemine.ru/" target="_blank">nicemine.ru</a>:443 -verify 99 <br>verify depth is 99<br>CONNECTED(00000003)<br>depth=2 /C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Certification Authority<br>verify error:num=19:self signed certificate in certificate chain<br>verify return:1<br>depth=2 /C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Certification Authority<br>verify return:1<br>depth=1 /C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Class 1 Primary Intermediate Server CA<br>verify return:1<br>depth=0 /<a href="mailto:C=KZ/CN=www.nicefiles.ru/emailAddress=webmaster@nicefiles.ru" target="_blank">C=KZ/CN=www.nicefiles.ru/emailAddress=webmaster@nicefiles.ru</a><br>verify return:1<br><br><br>and with it<br><br>$ openssl s_client -connect <a href="http://nicemine.ru/" target="_blank">nicemine.ru</a>:443 -verify 99 -CAfile cacert.pem<br>verify depth is 99<br>CONNECTED(00000003)<br>depth=2 /C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Certification Authority<br>verify return:1<br>depth=1 /C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Class 1 Primary Intermediate Server CA<br>verify return:1<br>depth=0 /<a href="mailto:C=KZ/CN=www.nicefiles.ru/emailAddress=webmaster@nicefiles.ru" target="_blank">C=KZ/CN=www.nicefiles.ru/emailAddress=webmaster@nicefiles.ru</a><br>verify return:1<br><br>so cacert.pem file contains enough info for StartCom certificates to be checked as valid.<br><br><br>Also I’ve tried to dig it more in erlang and I’ve found that I get error in OTP 18 too.<br><br>And the reason for bad certificate error is {bad_cert,invalid_issuer}<br><br><br><br>I also tried to add <a href="https://www.startssl.com/certs/sub.class1.server.ca.pem" target="_blank">https://www.startssl.com/certs/sub.class1.server.ca.pem</a> file to cacert.pem but with no luck.<br><br><br><br><br><br><blockquote type="cite">16 июля 2015 г., в 12:16, Alex Hudich <<a href="mailto:alttagil@gmail.com" target="_blank">alttagil@gmail.com</a>> написал(а):<br><br>Hi!<br><br><br><br>wget <a href="http://curl.haxx.se/ca/cacert.pem" target="_blank">http://curl.haxx.se/ca/cacert.pem</a><br><br>and then <br><br>ssl:connect( "<a href="http://www.nicemine.ru/" target="_blank">www.nicemine.ru</a>", 443, [{verify,verify_peer},{server_name_indication,"<a href="http://www.nicemine.ru/" target="_blank">www.nicemine.ru</a>"},{depth,2},{cacertfile,"cacert.pem"}] ).<br><br>gives me {error,{tls_alert,"bad certificate"}}<br><br><br><br>Why? Site can be opened ok in the browser.<br><br>Erlang/OTP 17 [erts-6.3] <br><br><br></blockquote><br></blockquote></div></div></div></blockquote></div><br></div><br>_______________________________________________<br>
erlang-questions mailing list<br>
<a href="mailto:erlang-questions@erlang.org" target="_blank">erlang-questions@erlang.org</a><br>
<a href="http://erlang.org/mailman/listinfo/erlang-questions" rel="noreferrer" target="_blank">http://erlang.org/mailman/listinfo/erlang-questions</a><br>
<br></blockquote></div><br></div>
</div></div></div></blockquote></div><br></div><br>_______________________________________________<br>
erlang-questions mailing list<br>
<a href="mailto:erlang-questions@erlang.org">erlang-questions@erlang.org</a><br>
<a href="http://erlang.org/mailman/listinfo/erlang-questions" rel="noreferrer" target="_blank">http://erlang.org/mailman/listinfo/erlang-questions</a><br>
<br></blockquote></div><br></div></div></div>