Letsencrypt ECDSA certificates

    • patched
  • mrpink
  • Closed
  • Thread is marked as Resolved.

    @mrpink


    Just made a test with a self-signed cert:


    private key

    Code
    1. ASN1 OID: prime256v1-----BEGIN EC PARAMETERS-----BggqhkjOPQMBBw==-----END EC PARAMETERS----------BEGIN EC PRIVATE KEY-----MHcCAQEEILjqEc3Qam26nxYOykqX+kxOin4M5OROrhAMO5gQKEQToAoGCCqGSM49AwEHoUQDQgAEPWkpW7yoQU8pm5aGTwdctldvw/dxDvvvWNnjAJDytKMBaEyn6LbitOkS8i5APO0k2324MnjkaeRfSMyxBcZZ+g==-----END EC PRIVATE KEY-----


    SSL cert (self-signed)

    Code
    1. -----BEGIN CERTIFICATE-----MIICXzCCAgagAwIBAgIJAJ8D7qyIYyuiMAkGByqGSM49BAEwgYwxCzAJBgNVBAYTAkZSMQ8wDQYDVQQIDAZGUkFOQ0UxDjAMBgNVBAcMBUVzc29uMQ4wDAYDVQQKDAVpTVNDUDEOMAwGA1UECwwFaU1TQ1AxFjAUBgNVBAMMDWNhLm51eHdpbi5jb20xJDAiBgkqhkiG9w0BCQEWFWwuZGVjbGVyY3FAbnV4d2luLmNvbTAeFw0xNjAzMjIyMjUwMzVaFw0xNzAzMjIyMjUwMzVaMIGMMQswCQYDVQQGEwJGUjEPMA0GA1UECAwGRlJBTkNFMQ4wDAYDVQQHDAVFc3NvbjEOMAwGA1UECgwFaU1TQ1AxDjAMBgNVBAsMBWlNU0NQMRYwFAYDVQQDDA1jYS5udXh3aW4uY29tMSQwIgYJKoZIhvcNAQkBFhVsLmRlY2xlcmNxQG51eHdpbi5jb20wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQ9aSlbvKhBTymbloZPB1y2V2/D93EO++9Y2eMAkPK0owFoTKfotuK06RLyLkA87STbfbgyeORp5F9IzLEFxln6o1AwTjAdBgNVHQ4EFgQUmZrsH2xcLCLlSBTKhKUyKPtlH18wHwYDVR0jBBgwFoAUmZrsH2xcLCLlSBTKhKUyKPtlH18wDAYDVR0TBAUwAwEB/zAJBgcqhkjOPQQBA0gAMEUCIDhCkp8F/TkZSV9fV2HdW/7YmLhJ8EkAQ5VBf6tYPTAcAiEA14gvnbaSqWt5CaT74mgg0xz6ZKbkp1VEomxI40IB/vU=-----END CERTIFICATE-----

    Script for test

    PHP
    1. <?php# Check for private key (here no password)$key = openssl_pkey_get_private("file://private.key", "");# Read SSL certificate$certificate = openssl_x509_read("file://certificate.pem");if(openssl_x509_check_private_key($certificate, $key) !== true) {print "The private key doesn't belongs to the provided SSL certificate.\n";} else {print "Private key is valid and belongs to provided SSL certificate\n";}


    Result: Private key is valid and belongs to provided SSL certificate


    Environment

    Code
    1. root@wheezy:~# lsb_release -aNo LSB modules are available.Distributor ID: DebianDescription: Debian GNU/Linux 7.9 (wheezy)Release: 7.9Codename: wheezyroot@wheezy:~# php -vPHP 5.4.45-0+deb7u2 (cli) (built: Oct 17 2015 08:26:31)Copyright (c) 1997-2014 The PHP GroupZend Engine v2.4.0, Copyright (c) 1998-2014 Zend Technologiesroot@wheezy:~#


    Info about the self-signed I've generated are as follow


    I'll give a try with your certifificate.

    badge.php?id=1239063037&bid=2518&key=1747635596&format=png&z=547451206

    SSH key for online support

    I tried the php script with the private key and certificate created from the bash script and it is also successful.
    But it is not working on the i-MSCP system. ?(

    @mrpink


    I'll test the bundle now ;)

    badge.php?id=1239063037&bid=2518&key=1747635596&format=png&z=547451206

    SSH key for online support

    @mrpink



    Problem seem to be on Backend side. Will fix that. BTW: I do my test with 1.2.x.

    badge.php?id=1239063037&bid=2518&key=1747635596&format=png&z=547451206

    SSH key for online support

    @mrpink


    Problem found. Right now we only support RSA key validation on backend side:


    Perl
    1. my @cmd = (
    2. 'openssl rsa', '-in', escapeShell( $self->{'private_key_container_path'} ), '-noout',
    3. $passphraseFile ? ('-passin', escapeShell( "file:$passphraseFile" )) : ''
    4. );

    I'll fix.

    badge.php?id=1239063037&bid=2518&key=1747635596&format=png&z=547451206

    SSH key for online support

    That's great. :thumbsup:


    It's not urgent, but I thought better talk now about it before others run into this issue.


    Thanks Laurent, great work.

    @mrpink


    Command is same. We need just replace rsa by ec. I must now figure out how check for key type.

    badge.php?id=1239063037&bid=2518&key=1747635596&format=png&z=547451206

    SSH key for online support

    Maybe checking the content of the first line:


    -----BEGIN RSA PRIVATE KEY-----


    -----BEGIN EC PARAMETERS-----

    @mrpink


    Too easy for me 8o

    badge.php?id=1239063037&bid=2518&key=1747635596&format=png&z=547451206

    SSH key for online support

    OK, then I'm curious how you will implement this. :P