<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Note: Also posted to <a href="https://github.com/ninenines/ranch/issues/179" class="">https://github.com/ninenines/ranch/issues/179</a> which might have better formatting.<div class=""><br class=""></div><div class=""><p style="box-sizing: border-box; margin-bottom: 16px; color: rgb(36, 41, 46); font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 14px; margin-top: 0px !important;" class="">I am trying to implement ADH algorithms but have been stuck and can’t seem to find anything to help…</p><div class=""><br class=""></div><div class="">Here is my code and issues:</div><div class=""><br class=""></div><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 16px; color: rgb(36, 41, 46); font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 14px;" class="">(Note: This is Elixir code calling to cowboy which I am told calls to ssl)</p><pre style="box-sizing: border-box; font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, Courier, monospace; font-size: 11.899999618530273px; margin-top: 0px; margin-bottom: 16px; word-wrap: normal; padding: 16px; overflow: auto; line-height: 1.45; background-color: rgb(246, 248, 250); border-top-left-radius: 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; color: rgb(36, 41, 46);" class=""><code style="box-sizing: border-box; font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, Courier, monospace; padding: 0px; margin: 0px; background-color: transparent; border-top-left-radius: 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; word-break: normal; border: 0px; display: inline; overflow: visible; line-height: inherit; word-wrap: normal;" class="">dispatch = :cowboy_router.compile([{:_, [
{"/", __MODULE__, initial_state}
]}]
{:ok, pid} = :cowboy.start_tls(
__MODULE__,
[
:inet6,
{:port, @http_port},
{:cacertfile, String.to_charlist(Path.join(priv_dir, "ssl/cowboy-ca.crt"))},
{:certfile, String.to_charlist(Path.join(priv_dir, "ssl/server.crt"))},
{:keyfile, String.to_charlist(Path.join(priv_dir, "ssl/server.key"))},
{:ciphers, [{:rsa, :aes_128_gcm, :null, :sha256}, {:dh_anon, :aes_256_cbc, :sha256}, {:dh_anon, :aes_256_gcm, :null, :sha384}]},
{:dhfile, String.to_charlist(Path.join(priv_dir, "ssl/dh.pem"))},
{:versions, [String.to_atom("tlsv1.2")]}
],
%{
env: %{dispatch: dispatch}
}
)</code></pre><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 16px; color: rgb(36, 41, 46); font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 14px;" class="">but always seem to get the error</p><pre style="box-sizing: border-box; font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, Courier, monospace; font-size: 11.899999618530273px; margin-top: 0px; margin-bottom: 16px; word-wrap: normal; padding: 16px; overflow: auto; line-height: 1.45; background-color: rgb(246, 248, 250); border-top-left-radius: 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; color: rgb(36, 41, 46);" class=""><code style="box-sizing: border-box; font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, Courier, monospace; padding: 0px; margin: 0px; background-color: transparent; border-top-left-radius: 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; word-break: normal; border: 0px; display: inline; overflow: visible; line-height: inherit; word-wrap: normal;" class="">08:40:45.886 [info] ['TLS', 32, 'server', 58, 32, 73, 110, 32, 115, 116, 97, 116, 101, 32, 'certify', 32, 'received CLIENT ALERT: Fatal - Decode Error', 10]
</code></pre><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 16px; color: rgb(36, 41, 46); font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 14px;" class="">which corresponds to the client giving error</p><pre style="box-sizing: border-box; font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, Courier, monospace; font-size: 11.899999618530273px; margin-top: 0px; margin-bottom: 16px; word-wrap: normal; padding: 16px; overflow: auto; line-height: 1.45; background-color: rgb(246, 248, 250); border-top-left-radius: 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; color: rgb(36, 41, 46);" class=""><code style="box-sizing: border-box; font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, Courier, monospace; padding: 0px; margin: 0px; background-color: transparent; border-top-left-radius: 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; word-break: normal; border: 0px; display: inline; overflow: visible; line-height: inherit; word-wrap: normal;" class="">curl: (35) error:1408D099:SSL routines:SSL3_GET_KEY_EXCHANGE:extra data in message
</code></pre><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 16px; color: rgb(36, 41, 46); font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 14px;" class="">I have tried other ciphers and am able to establish a TLS connection. Here is some example <code style="box-sizing: border-box; font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, Courier, monospace; font-size: 11.899999618530273px; padding: 0.2em 0.4em; margin: 0px; background-color: rgba(27, 31, 35, 0.0470588); border-top-left-radius: 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; border-bottom-left-radius: 3px;" class="">curl</code>requests</p><pre style="box-sizing: border-box; font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, Courier, monospace; font-size: 11.899999618530273px; margin-top: 0px; word-wrap: normal; padding: 16px; overflow: auto; line-height: 1.45; background-color: rgb(246, 248, 250); border-top-left-radius: 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; color: rgb(36, 41, 46); margin-bottom: 0px !important;" class=""><code style="box-sizing: border-box; font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, Courier, monospace; padding: 0px; margin: 0px; background-color: transparent; border-top-left-radius: 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; word-break: normal; border: 0px; display: inline; overflow: visible; line-height: inherit; word-wrap: normal;" class="">Chriss-MacBook-Pro:~ chris$ curl -v --insecure --ciphers AES128-GCM-SHA256 <a href="https://localhost:8002" class="">https://localhost:8002</a>
* Rebuilt URL to: <a href="https://localhost:8002/" class="">https://localhost:8002/</a>
* Trying ::1...
* TCP_NODELAY set
* Connected to localhost (::1) port 8002 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: AES128-GCM-SHA256
* successfully set certificate verify locations:
* CAfile: /etc/ssl/cert.pem
CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / AES128-GCM-SHA256
* ALPN, server accepted to use h2
* Server certificate:
* subject: C=US; ST=Texas; O=Nine Nines; OU=Cowboy; CN=localhost
* start date: Feb 28 05:23:34 2013 GMT
* expire date: Feb 23 05:23:34 2033 GMT
* issuer: C=US; ST=Texas; O=Nine Nines; OU=Cowboy; CN=ROOT CA
* SSL certificate verify result: self signed certificate in certificate chain (19), continuing anyway.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x7feba8805800)
> GET / HTTP/2
> Host: localhost:8002
> User-Agent: curl/7.54.0
> Accept: */*
>
* Connection state changed (MAX_CONCURRENT_STREAMS updated)!
< HTTP/2 200
< content-length: 0
< content-type: application/json
< date: Tue, 23 Jan 2018 16:40:35 GMT
< server: Cowboy
<
* Connection #0 to host localhost left intact
Chriss-MacBook-Pro:~ chris$ curl -v --insecure --ciphers ADH-AES256-SHA256 <a href="https://localhost:8002" class="">https://localhost:8002</a>
* Rebuilt URL to: <a href="https://localhost:8002/" class="">https://localhost:8002/</a>
* Trying ::1...
* TCP_NODELAY set
* Connected to localhost (::1) port 8002 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ADH-AES256-SHA256
* successfully set certificate verify locations:
* CAfile: /etc/ssl/cert.pem
CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (OUT), TLS alert, Server hello (2):
* error:1408D099:SSL routines:SSL3_GET_KEY_EXCHANGE:extra data in message
* stopped the pause stream!
* Closing connection 0
curl: (35) error:1408D099:SSL routines:SSL3_GET_KEY_EXCHANGE:extra data in message
Chriss-MacBook-Pro:~ chris$ curl -v --insecure --ciphers ADH-AES256-GCM-SHA384 <a href="https://localhost:8002" class="">https://localhost:8002</a>
* Rebuilt URL to: <a href="https://localhost:8002/" class="">https://localhost:8002/</a>
* Trying ::1...
* TCP_NODELAY set
* Connected to localhost (::1) port 8002 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ADH-AES256-GCM-SHA384
* successfully set certificate verify locations:
* CAfile: /etc/ssl/cert.pem
CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (OUT), TLS alert, Server hello (2):
* error:1408D099:SSL routines:SSL3_GET_KEY_EXCHANGE:extra data in message
* stopped the pause stream!
* Closing connection 0
curl: (35) error:1408D099:SSL routines:SSL3_GET_KEY_EXCHANGE:extra data in message
</code></pre><div class=""><br class=""></div></div><div class=""><br class=""></div><div class="">Am I missing something?</div></body></html>