<!DOCTYPE html><html><head><title></title><style type="text/css">p.MsoNormal,p.MsoNoSpacing{margin:0}</style></head><body><div>Hey,<br></div><div><br></div><div>I confirm that out of order certs does not seems to be fixed, and it fails with 'Unknown CA' error:<br></div><div><br></div><div><br></div><div>iex(2)> :hackney.get("<a href="https://social.fluffel.io">https://social.fluffel.io</a>")<br></div><div>{:error,<br></div><div>{:tls_alert, {:unknown_ca, 'received CLIENT ALERT: Fatal - Unknown CA'}}}<br></div><div><br></div><div><br></div><div>the only issue with this server TLS certificates is the chain order (CA is Letsencrypt): <a href="https://www.ssllabs.com/ssltest/analyze.html?d=social.fluffel.io">https://www.ssllabs.com/ssltest/analyze.html?d=social.fluffel.io</a><br></div><div><br></div><div><br></div><div>On Sat, Nov 2, 2019, at 01:12, Curtis J Schofield wrote:<br></div><blockquote type="cite" id="qt"><div>Hi!<br></div><div><br></div><div>Just curious if there is an update on out of order certs.<br></div><div><br></div><div>The example has id0, id1, id2, id3 certs with id1 being the natural<br></div><div>root of id2 who is the root of id3, who is the root of id0.<br></div><div><br></div><div>We can correct the out of order problem by including id1,id2,id3 certs<br></div><div>in our chain.<br></div><div><br></div><div>It would be nice to hear from the erlang maintainers around what kind of<br></div><div>"out of order" erlang can handle nicely and if there is planned support for<br></div><div>our case!<br></div><div><br></div><div>Thank you again,<br></div><div><br></div><div>Curtis.<br></div><div><br></div><div><br></div><div class="qt-protonmail_signature_block"><div class="qt-protonmail_signature_block-user"><div>Sent through <a href="https://protonmail.com">ProtonMail</a> Encrypted Email Channel.<br></div></div><div class="qt-protonmail_signature_block-proton qt-protonmail_signature_block-empty"><br></div></div><div><br></div><div>‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐<br></div><div>On Saturday, October 19, 2019 4:34 PM, Curtis J Schofield <curtis@ram9.cc> wrote:<br></div><div><br></div><blockquote type="cite" class="qt-protonmail_quote"><div>Hi! Thank you.<br></div><div><br></div><div><br></div><div>I included the root cert in the example. The root cert is id1 in cert chain - this is evident in the other file. <br></div><div><br></div><div>It seems because the root cert is out of order - the cert chain is invalid - IIRC this may be true for tls1.2 - however the negotiation is at TLS1.2<br></div><div><br></div><div><br></div><div>Thank you for your consideration!<br></div><div><br></div><div><br></div><div id="qt-protonmail_mobile_signature_block"><div>Sent from ProtonMail Mobile<br></div></div><div><br></div><div><br></div><div>On Sat, Oct 19, 2019 at 10:51 AM, Ingela Andin <<a class="qt-" href="mailto:ingela.andin@gmail.com">ingela.andin@gmail.com</a>> wrote:<br></div><blockquote type="cite" class="qt-protonmail_quote"><div dir="ltr"><div><br></div><div>Hi!<br></div><div><br></div><div>"Unknown CA" means that you did not have the ROOT certificate of the chian in your "trusted store" (cacerts option).<br></div><div>If you do not own the ROOT certificate you can not trust the chain.<br></div><div><br></div><div>Regards Ingela Erlang/OTP Team - Ericsson AB<br></div><div><br></div><div class="qt-gmail_quote"><div dir="ltr">Den fre 18 okt. 2019 kl 21:52 skrev Curtis J Schofield <curtis@ram9.cc>:<br></div><blockquote style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-color:rgb(204, 204, 204);border-left-style:solid;border-left-width:1px;padding-left:1ex;" class="qt-gmail_quote"><div>Dear Erlang Questions:<br></div><div><br></div><div><br></div><div>SSL 9.0.2 mentions a patch to fix out of order cert chains<br></div><div><br></div><div>In SSL 9.2 we have a root CA and an out of order cert chain<br></div><div>for host <a rel="noreferrer" href="http://hooks.glip.com">hooks.glip.com</a>.<br></div><div><br></div><div>When we try to verify peer with the out of order cert<br></div><div>chain we get 'Unknown CA'.<br></div><div><br></div><div>Is this expected behaviour for Erlang SSL 9.2 with verify_peer ?<br></div><div><br></div><div>The <a rel="noreferrer" href="http://erlang.org/doc/apps/ssl/notes.html#ssl-9.0.2">http://erlang.org/doc/apps/ssl/notes.html#ssl-9.0.2</a> notes<br></div><div>mention that other care may need to be taken to ensure compatibility.<br></div><div><br></div><div>Reproduce error:<br></div><div><br></div><div><a rel="noreferrer" href="https://github.com/robotarmy/out-of-order-ssl">https://github.com/robotarmy/out-of-order-ssl</a><br></div><div><br></div><div>Thank you,<br></div><div>Curtis and Team DevEco<br></div><div><br></div><div><br></div><div><br></div><div><br></div><div>Sent through ProtonMail Encrypted Email Channel.<br></div><div><br></div><div><br></div><div>_______________________________________________<br></div><div>erlang-questions mailing list<br></div><div><a href="mailto:erlang-questions@erlang.org">erlang-questions@erlang.org</a><br></div><div><a rel="noreferrer" href="http://erlang.org/mailman/listinfo/erlang-questions">http://erlang.org/mailman/listinfo/erlang-questions</a><br></div></blockquote></div></div></blockquote><div><br></div><div><br></div></blockquote><div><br></div></blockquote><div><br></div></body></html>