<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Apple Color Emoji";
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.gmail-code
{mso-style-name:gmail-code;}
span.gmail-boldcode
{mso-style-name:gmail-bold_code;}
span.gmail-hoenzb
{mso-style-name:gmail-hoenzb;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Hi Ingela,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Ok, that’s what I was starting to think the right approach is as well. Do you have an example of implementing this function? I’m just a rabbitmq user, not an Erlang developer.
But sounds like I’ll get to learn a thing or two about a new language </span><span style="font-size:11.0pt;font-family:"Apple Color Emoji"">☺</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Adam<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-family:"Calibri",sans-serif;color:black">From:
</span></b><span style="font-family:"Calibri",sans-serif;color:black">Ingela Andin <ingela.andin@gmail.com><br>
<b>Date: </b>Wednesday, June 7, 2017 at 2:07 PM<br>
<b>To: </b>Adam Bloom <Adam.Bloom@viasat.com><br>
<b>Cc: </b>"erlang-questions@erlang.org" <erlang-questions@erlang.org><br>
<b>Subject: </b>Re: [erlang-questions] SSL peer certificate verification - RabbitMQ<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Hi! <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">You should use the partial chain option. The fun shall return the intermediate cert present in the inputed Chain that it wants to trust. The depth option specifies the maximum intermediate CAs there<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">can be in the chain, that is not what you want.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span class="gmail-code"><span style="font-size:13.5pt;font-family:"Courier",serif;color:black">"{partial_chain, fun(Chain::[DerCert]) -> {trusted_ca, DerCert} | unknown_ca }</span></span><o:p></o:p></p>
<p style="margin-left:.5in"><span style="font-size:13.5pt;font-family:"Verdana",sans-serif;color:black">Claim an intermediate CA in the chain as trusted. TLS then performs </span><span class="gmail-boldcode"><b><span style="font-size:13.5pt;font-family:"Courier",serif;color:black"><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__erlang.org_doc_man_public-5Fkey.html-23pkix-5Fpath-5Fvalidation-2D3&d=DwMFaQ&c=jcv3orpCsv7C4ly8-ubDob57ycZ4jvhoYZNDBA06fPk&r=pVjMG-Ic_gFf_XuCeIHdvT-JeR4iyCqatl3BZUquOU8&m=RdLD9uLBXT7i2qO5z3I7haERmcOZ37ixd02093FC6ws&s=pBqdi5eawOebOQIbO_8E5Ea7d81OVPcSFqU3GR1cq1g&e=">public_key:pkix_path_validation/3</a></span></b></span><span style="font-size:13.5pt;font-family:"Verdana",sans-serif;color:black"> with
the selected CA as trusted anchor and the rest of the chain."<o:p></o:p></span></p>
<p style="margin-left:.5in"><span style="font-size:13.5pt;font-family:"Verdana",sans-serif;color:black"><o:p> </o:p></span></p>
<p style="margin-left:.5in"><span style="font-size:13.5pt;font-family:"Verdana",sans-serif;color:black">Regards Ingela Erlang/OTP team<o:p></o:p></span></p>
<p style="margin-left:.5in"><span style="font-size:13.5pt;font-family:"Verdana",sans-serif;color:black"><o:p> </o:p></span></p>
<p style="margin-left:.5in"><span style="font-size:13.5pt;font-family:"Verdana",sans-serif;color:black"><o:p> </o:p></span></p>
<p style="margin-left:.5in"><span style="font-size:13.5pt;font-family:"Verdana",sans-serif;color:black"><o:p> </o:p></span></p>
<p style="margin-left:.5in"><span style="font-size:13.5pt;font-family:"Verdana",sans-serif;color:black"><o:p> </o:p></span></p>
<div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:13.5pt;font-family:"Verdana",sans-serif;color:black">2017-06-05 20:27 GMT+02:00 Bloom, Adam <<a href="mailto:Adam.Bloom@viasat.com" target="_blank">Adam.Bloom@viasat.com</a>>:<o:p></o:p></span></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:black">Hello,</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:black">Hoping that one of you knows some secrets you can impart in me to get SSL peer verification working from RabbitMQ. I’ve been digging through the source code of the underlying Erlang SSL library to no avail. In particular,
I’m struggling to understand the depth setting. According to the docs (<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__erlang.org_doc_man_ssl.html&d=DwMFaQ&c=jcv3orpCsv7C4ly8-ubDob57ycZ4jvhoYZNDBA06fPk&r=pVjMG-Ic_gFf_XuCeIHdvT-JeR4iyCqatl3BZUquOU8&m=RdLD9uLBXT7i2qO5z3I7haERmcOZ37ixd02093FC6ws&s=SvDIXk5--5EFPmkoBywSdMm7VbEsIbeBC_8xn1vXigc&e=" target="_blank">http://erlang.org/doc/man/ssl.html</a>):</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:black">{depth, integer()}</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:black">Maximum number of non-self-issued intermediate certificates that can follow the peer certificate in a valid certification path. So, if depth is 0 the PEER must be signed by the trusted ROOT-CA directly; if 1 the path
can be PEER, CA, ROOT-CA; if 2 the path can be PEER, CA, CA, ROOT-CA, and so on. The default value is 1.</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:black">I have two certificates (client and server) signed by the same intermediate CA. I would like to restrict rabbitmq to only accept connections from this (and potentially one more) intermediate CA. My initial thought
was to set depth to 0 and place the intermediate ca (followed by the root ca) in the CA cert file. If I do this, the client is unable to connect and the server logs the following error:</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:black">SSL: certify: ssl_handshake.erl:1627:Fatal error: handshake failure - {bad_cert,max_path_length_reached}.</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:black">If I change depth to 1, the connection works. Rabbitmq also allows a cert signed by another intermediate ca (same root) to connect, which is what I’d like to prevent. This follows from the ssl man page though.</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:black">Can someone please advise me on the proper use of the “depth” setting in the Erlang ssl library such that only certificates signed by the trusted intermediate are able to connect? Do I need to remove the root CA from
the CA cert file and explore partial_chain handlers?</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:black">Here are my current ssl_options settings from rabbitmq:</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:black">{ssl_options, [</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:black"> {cacertfile, "/etc/rabbitmq/certs/cacert.pem"},</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:black"> {certfile, "/etc/rabbitmq/certs/cert.pem"},</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:black"> {keyfile, "/etc/rabbitmq/certs/key.pem"},</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:black"> {verify, verify_peer},</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:black"> {depth, 1},</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:black"> {fail_if_no_peer_cert, true},</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:black"> {versions, ['tlsv1.2']}</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:black"> ]},</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:black">Thanks,</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:#888888"> </span><span style="color:#888888"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:11.0pt;color:#888888">Adam</span><span style="color:#888888"><o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:13.5pt;margin-left:.5in">
<span style="font-size:13.5pt;font-family:"Verdana",sans-serif;color:black"><br>
_______________________________________________<br>
erlang-questions mailing list<br>
<a href="mailto:erlang-questions@erlang.org">erlang-questions@erlang.org</a><br>
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__erlang.org_mailman_listinfo_erlang-2Dquestions&d=DwMFaQ&c=jcv3orpCsv7C4ly8-ubDob57ycZ4jvhoYZNDBA06fPk&r=pVjMG-Ic_gFf_XuCeIHdvT-JeR4iyCqatl3BZUquOU8&m=RdLD9uLBXT7i2qO5z3I7haERmcOZ37ixd02093FC6ws&s=2yUA3gyFKv6SfIAeC10OfX5EjTOWCCpfw8BCIILZs8g&e=" target="_blank">http://erlang.org/mailman/listinfo/erlang-questions</a><o:p></o:p></span></p>
</blockquote>
</div>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:13.5pt;font-family:"Verdana",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
</div>
</div>
</div>
</body>
</html>