Letsencrypt ECDSA certificates

mafioso · Mar 23rd 2016

Hm isn't it a comment which can be removed? I think with openssl -inform it should be possible

**Nuxwin** · Mar 23rd 2016

Well, assuming that we will only accept traditional encrypted EC format

Something like

Perl

my $keyType = execute('openssl x509 -in certificate.pem -text -noout |grep -q ecds', \my $stdout, my $stderr) == 0 ? 'ec' : 'rsa';

should be ok

**Nuxwin** · Mar 23rd 2016

Or better

Code

root@wheezy:~# openssl asn1parse -i -in private.key
0:d=0 hl=2 l= 119 cons: SEQUENCE
2:d=1 hl=2 l= 1 prim: INTEGER :01
5:d=1 hl=2 l= 32 prim: OCTET STRING [HEX DUMP]:B8EA11CDD06A6DBA9F160ECA4A97FA4C4E8A7E0CE4E44EAE100C3B9810284413
39:d=1 hl=2 l= 10 cons: cont [ 0 ]
41:d=2 hl=2 l= 8 prim: OBJECT :prime256v1
51:d=1 hl=2 l= 68 cons: cont [ 1 ]
53:d=2 hl=2 l= 66 prim: BIT STRING

On the key directly

**Nuxwin** · Mar 23rd 2016

finally, generic command which should work for both format is:

Code

mrpink · Mar 23rd 2016

Quote from Nuxwin

finally, generic command which should work for both format is:

Code

openssl pkey -in private.key -pubout

But how do you distinguish between ECDSA and RSA with this command?
The only difference is the length of the key.

**Nuxwin** · Mar 23rd 2016

Can you give a try:

In the file engine/PerlLib/iMSCP/OpenSSL.pm (in the validatePrivateKey subroutine) Replace:

Perl

my @cmd = ( 'openssl rsa', '-in', escapeShell( $self->{'private_key_container_path'} ), '-noout', $passphraseFile ? ('-passin', escapeShell( "file:$passphraseFile" )) : '');

by

Quote from mrpink

The only difference is the length of the key.

Perl

my @cmd = ( 'openssl pkey', '-in', escapeShell( $self->{'private_key_container_path'} ), '-noout', $passphraseFile ? ('-passin', escapeShell( "file:$passphraseFile" )) : '');

Once done, try again to add your cert through GUI.Thank for testing.

Edit:

Quote from mrpink

The only difference is the length of the key.

No, the used curve is also part of the key.

**Nuxwin** · Mar 23rd 2016

Forgot other line that you must also change so wait. Better is the commit which will comes in two minutes

mrpink · Mar 23rd 2016

First test automated with the bash script I get this error after imscp-rqst-mngr

Code

[ERROR] iMSCP::OpenSSL::importPrivateKey: Could not import SSL private key: 140545780872848:error:0607907F:digital envelope routines:EVP_PKEY_get1_RSA:expecting an rsa key:p_lib.c:288:

mrpink · Mar 23rd 2016

Quote from Nuxwin

Forgot other line that you must also change so wait. Better is the commit which will come in two minutes

Ok, then I'll wait.

**Nuxwin** · Mar 23rd 2016

Yeah

Just wait my commit. I forgot to give you another line to change The commit comes now.

Share