helpGnuTLS - Support: sr #107424, gnutls cannot handle...

 
 

sr #107424: gnutls cannot handle openssl-1.0.o.a certs

Submitted by:  None
Submitted on:  Fri 09 Jul 2010 09:22:55 AM UTC  
 
Category:  None Priority:  5 - Normal
Severity:  3 - Normal Status:  Done
Privacy:  Public Assigned to:  Nikos Mavrogiannopoulos <nmav>
Originator Email:  -email is unavailable- Open/Closed:  Closed
Operating System:  GNU/Linux

Add a New Comment (Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

( Jump to the original submission)

Sun 25 Jul 2010 10:56:11 AM UTC, comment #8: 

Thank you Nikos, it's now working in WeeChat with your tip.

Sebastien Helleu <flashcode>
Sun 25 Jul 2010 07:29:05 AM UTC, comment #7: 

The format changed to PKCS #8 encoding. GnuTLS supports it but
requires different function calls to import those keys. The issue with gnutls-cli will be solved on the next gnutls release. My recommendation was for a fix that you can apply to your program and not depending on a new gnutls release.

Nikos Mavrogiannopoulos <nmav>
Project AdministratorIn charge of this item.
Sat 24 Jul 2010 09:17:23 PM UTC, comment #6: 

Hi Nikos,

Our problem is with WeeChat, but in our bug report, it's problem with gnutls-cli command. How can you explain this error? Perhaps we're giving wrong arguments to gnutls-cli?

For me, there's a difference in files generated with openssl 0.9.x and openssl 1.0.0. But I don't know enough these files to say what exactly has changed.

Sebastien Helleu <flashcode>
Sat 24 Jul 2010 02:07:19 PM UTC, comment #5: 

So I suppose in your code you do:
  ret = gnutls_x509_privkey_import (tmpkey, raw_key, type);

to import the key. I suggest to add
  /* If normal key decoding doesn't work try decoding a PKCS #8 key */
  if (ret < 0)
    ret = gnutls_x509_privkey_import_pkcs8 (tmpkey, raw_key, type,
                      NULL, GNUTLS_PKCS_PLAIN);

Nikos Mavrogiannopoulos <nmav>
Project AdministratorIn charge of this item.
Sat 24 Jul 2010 01:34:11 PM UTC, comment #4: 

> What is the issue with them? I can read them properly by using certtool. It's just a typical certificate.


See https://savannah.nongnu.org/bugs/index.php?30316#comment3

Sincerely,
Gour

Anonymous
Sat 24 Jul 2010 12:06:56 PM UTC, comment #3: 

What is the issue with them? I can read them properly by using certtool. It's just a typical certificate.

Nikos Mavrogiannopoulos <nmav>
Project AdministratorIn charge of this item.
Sat 24 Jul 2010 11:46:46 AM UTC, comment #2: 

Hello!

I uploaded key, cert & pem file so you can test it.

Sincerely,
Gour

Anonymous
Sat 24 Jul 2010 11:00:31 AM UTC, comment #1: 

Could you please attach the certificates with the problem so we can verify the issue?

Nikos Mavrogiannopoulos <nmav>
Project AdministratorIn charge of this item.
Fri 09 Jul 2010 09:22:55 AM UTC, original submission:  

Hello!

Several Archlinux users experienced problem when attempting to connect to OFTC irc server via SSL from weechat client.

The bug was submitted to Weechat (https://savannah.nongnu.org/bugs/index.php?30316), but after playing with it I've found out that the problem is that gnutls (which is used by weechat) cannot handle SSL certificates created by openssl-1.0.0.a which are different than those created with e.g. openssl-0.9.80.

The exact error message is available on the above weechat bug tracker.

Sincerely,
Gour

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #21047:  test.cer added by None (1KiB - chemical/x-cerius - test key & certificates created with openssl-1.0a)
file #21048:  test.key added by None (2KiB - application/pgp-keys - test key & certificates created with openssl-1.0a)
file #21049:  test.pem added by None (3KiB - application/octet-stream - test key & certificates created with openssl-1.0a)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by flashcode (Posted a comment)
  • -email is unavailable- added by nmav (Posted a comment)
  • -email is unavailable- added by flashcode
  • -email is unavailable- added by None (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-09-29 nmav StatusNone => Done
        Assigned toNone => nmav
        Open/ClosedOpen => Closed
    2010-07-24 None Attached File- => Added test.cer, #21047
        Attached File- => Added test.key, #21048
        Attached File- => Added test.pem, #21049
    2010-07-09 flashcode Carbon-Copy- => Added flashcode

    Back to the top


    Powered by Savane 3.7