* https://unicorn.bogomips.org accepts client certificate?
@ 2016-03-15 7:36 Shota Fukumori (sora_h)
2016-03-15 8:58 ` Eric Wong
0 siblings, 1 reply; 7+ messages in thread
From: Shota Fukumori (sora_h) @ 2016-03-15 7:36 UTC (permalink / raw)
To: unicorn-public
Hi,
I found that https://unicorn.bogomips.org/ accepts client certificate.
My browser prompts what certificate to use for a connection, even
https://unicorn.bogomips.org/ doesn't require a client certificate.
I and my colleagues are surprised about browser asking it. I guess
this is unexpected behavior, is it expected?
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: https://unicorn.bogomips.org accepts client certificate?
2016-03-15 7:36 https://unicorn.bogomips.org accepts client certificate? Shota Fukumori (sora_h)
@ 2016-03-15 8:58 ` Eric Wong
2016-03-15 9:21 ` Shota Fukumori (sora_h)
0 siblings, 1 reply; 7+ messages in thread
From: Eric Wong @ 2016-03-15 8:58 UTC (permalink / raw)
To: Shota Fukumori (sora_h); +Cc: unicorn-public, yahns-public
"Shota Fukumori (sora_h)" <her@sorah.jp> wrote:
> Hi,
>
> I found that https://unicorn.bogomips.org/ accepts client certificate.
> My browser prompts what certificate to use for a connection, even
> https://unicorn.bogomips.org/ doesn't require a client certificate.
+Cc yahns-public@yhbt.net
Likely a bug in yahns or the OpenSSL configuration of it.
I have also been running some experimental ruby-trunk or
yahns patches related to https://bugs.ruby-lang.org/issues/12126
so maybe I left something out in a deployment[1]...
Which client(s) are you using?
curl, w3m, lynx on both Debian jessie and wheezy all seem fine.
openssl s_client -connect unicorn.bogomips.org:443 -CApath /etc/ssl/
Also seems fine. As does the following Ruby snippet:
require 'uri'
require 'net/https'
uri = URI('https://unicorn.bogomips.org/')
req = Net::HTTP::Get.new(uri)
res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |http|
p http.request(req)
end
I suppose there will be problems with old clients that can't
handle SNI or newer/stronger encryption.
> I and my colleagues are surprised about browser asking it. I guess
> this is unexpected behavior, is it expected?
I've not advertised the https site for unicorn yet;
it's just an experiment at this point[2]
Given the flurry of 1.12.x releases regarding TLS issues in
yahns, it's safe to say there are likely bugs how yahns does
TLS:
http://yhbt.net/yahns-public/20160229-yahns-1.12.2-unle@shed/t/
Fwiw, here's the OpenSSL SSLContext config I use with yahns 1.12.2
require 'openssl'
ctx = OpenSSL::SSL::SSLContext.new
ctx.cert = OpenSSL::X509::Certificate.new(IO.read(
'/etc/ssl/certs/dcvr.yhbt.net.crt'))
ctx.extra_chain_cert = [ OpenSSL::X509::Certificate.new(IO.read(
'/etc/ssl/certs/dcvr.yhbt.net.chain.crt')) ]
ctx.key = OpenSSL::PKey::RSA.new(IO.read(
'/etc/ssl/private/dcvr.yhbt.net.key'))
ctx.set_params
I'm really not that knowledgeable when it comes to OpenSSL[3].
Is there a WEBrick or similar pure Ruby config you can mimic
the problem with?
[1] Anyways I'm on yahns 1.12.2, now, my curl check runs
periodically and never reported any TLS-related error
in weeks.
[2] And will remain experimental indefinitely given my
lack-of-trust in both the CA system and the quality
of OpenSSL itself.
[3] I'm afraid my attempt to use/read the openssl C library
code back in the the 2000s traumatized me for good :x
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: https://unicorn.bogomips.org accepts client certificate?
2016-03-15 8:58 ` Eric Wong
@ 2016-03-15 9:21 ` Shota Fukumori (sora_h)
2016-03-15 9:43 ` russm
0 siblings, 1 reply; 7+ messages in thread
From: Shota Fukumori (sora_h) @ 2016-03-15 9:21 UTC (permalink / raw)
To: Eric Wong; +Cc: unicorn-public, yahns-public
Confirmed at least Chrome, Safari, Firefox on OS X El Capitan, and
Microsoft Edge on Windows 10.
> I've not advertised the https site for unicorn yet;
I thought so too, but at least google is using https url for their
search result.
--
Shota Fukumori a.k.a. @sora_h http://sorah.jp/
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: https://unicorn.bogomips.org accepts client certificate?
2016-03-15 9:21 ` Shota Fukumori (sora_h)
@ 2016-03-15 9:43 ` russm
2016-03-15 23:20 ` Shota Fukumori (sora_h)
0 siblings, 1 reply; 7+ messages in thread
From: russm @ 2016-03-15 9:43 UTC (permalink / raw)
To: Shota Fukumori (sora_h); +Cc: Eric Wong, unicorn-public, yahns-public
On Tue, Mar 15, 2016 at 06:21:01PM +0900, Shota Fukumori (sora_h) wrote:
> Confirmed at least Chrome, Safari, Firefox on OS X El Capitan, and
> Microsoft Edge on Windows 10.
FWIW, I see this with Chrome 49 on OSX 10.11, but *not* Chrome 49 on
Debian 8.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: https://unicorn.bogomips.org accepts client certificate?
2016-03-15 9:43 ` russm
@ 2016-03-15 23:20 ` Shota Fukumori (sora_h)
2016-03-15 23:30 ` Eric Wong
0 siblings, 1 reply; 7+ messages in thread
From: Shota Fukumori (sora_h) @ 2016-03-15 23:20 UTC (permalink / raw)
To: russm; +Cc: Eric Wong, unicorn-public, yahns-public
To be clear, you have to have a client certificate on your certificate
manager to be prompted.
Server doesn't specify acceptable client certificate CA names, so any
client certificate is ok.
On Tue, Mar 15, 2016 at 6:43 PM, russm <russm-rubyforge@slofith.org> wrote:
> On Tue, Mar 15, 2016 at 06:21:01PM +0900, Shota Fukumori (sora_h) wrote:
>> Confirmed at least Chrome, Safari, Firefox on OS X El Capitan, and
>> Microsoft Edge on Windows 10.
>
> FWIW, I see this with Chrome 49 on OSX 10.11, but *not* Chrome 49 on
> Debian 8.
--
Shota Fukumori a.k.a. @sora_h http://sorah.jp/
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: https://unicorn.bogomips.org accepts client certificate?
2016-03-15 23:20 ` Shota Fukumori (sora_h)
@ 2016-03-15 23:30 ` Eric Wong
2016-03-15 23:54 ` Shota Fukumori (sora_h)
0 siblings, 1 reply; 7+ messages in thread
From: Eric Wong @ 2016-03-15 23:30 UTC (permalink / raw)
To: Shota Fukumori (sora_h); +Cc: russm, unicorn-public, yahns-public
"Shota Fukumori (sora_h)" <her@sorah.jp> wrote:
> To be clear, you have to have a client certificate on your certificate
> manager to be prompted.
> Server doesn't specify acceptable client certificate CA names, so any
> client certificate is ok.
Thanks for the report, I think I just fixed the problem:
ctx.set_params # reasonable defaults for clients, apparently
However, webrick and drb both set VERIFY_NONE for servers:
ctx.set_params(verify_mode: OpenSSL::SSL::VERIFY_NONE)
I've updated https://unicorn.bogomips.org/ with the above change,
can you confirm it works for you? If so, I'll update the yahns
documentation.
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2016-03-15 23:55 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-03-15 7:36 https://unicorn.bogomips.org accepts client certificate? Shota Fukumori (sora_h)
2016-03-15 8:58 ` Eric Wong
2016-03-15 9:21 ` Shota Fukumori (sora_h)
2016-03-15 9:43 ` russm
2016-03-15 23:20 ` Shota Fukumori (sora_h)
2016-03-15 23:30 ` Eric Wong
2016-03-15 23:54 ` Shota Fukumori (sora_h)
Code repositories for project(s) associated with this public inbox
https://yhbt.net/unicorn.git/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).