CODEWITHSUNDEEP
kotlinvert.x
Ebadta
Ebadta

Reputation: 377

Let's Encrypt with vert.x

I got valid https certificate from Let's Encrypt, but have trust issues giving it to vert.x version 3.6.2

I tested the cert with apache, it's ok, however if I try to reach the https vert.x server instance with wget I get:

$ wget https://www.myhost.mydomain/json/read/all-languages
--2019-01-22 10:30:56-- https://www.myhost.mydomain/json/read/all-languages
Resolving www.myhost.mydomain (www.myhost.mydomain)... 88.14.34.156
Connecting to www.myhost.mydomain >(www.myhost.mydomain)|88.14.34.156|:443... connected.
ERROR: cannot verify www.myhost.mydomain's certificate, issued by >‘CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US’: Unable to locally verify the issuer's authority.
To connect to www.myhost.mydomain insecurely, use `--no-check->certificate'.

Hostname and ip is forged.

my working apache config snippet:

SSLCertificateFile /etc/certs/myhost.mydomain/cert.pem
SSLCertificateKeyFile /etc/certs/myhost.mydomain/privkey.pem
SSLCertificateChainFile /etc/certs/myhost.mydomain/chain.pem

vert.x code:

val httpsOptions = HttpServerOptions()
.setPort(443)
.setSsl(true)
.setPemTrustOptions(PemTrustOptions()
    .addCertPath("/etc/certs/myhost.mydomain/chain.pem"))
.setPemKeyCertOptions(PemKeyCertOptions()
    .addKeyPath("/etc/certs/myhost.mydomain/privkey.pem")
    .addCertPath("/etc/certs/myhost.mydomain/cert.pem")
)
vertx.createHttpServer(httpsOptions).requestHandler(router).listen()


I set vert.x logging to debug, but no error message appears.

What am I missing?

Upvotes: 2

Views: 991

Answers (2)

Ebadta
Ebadta

Reputation: 377

I found the solution here: https://community.letsencrypt.org/t/android-doesnt-trust-the-certificate/16498/2

I changed the cert.pem to fullchain.pem in the setPemKeyCertOptions settings, and it works.

Thank you for your effort.

Upvotes: 1

petarov
petarov

Reputation: 129

The issue is in the certificate chain file chain.pem. It seems that it does not contain the full certificate chain. If you view the file it probably contains only one intermediate LE authority cert inside, i.e., Let's Encrypt Authority X3. It works with Apache because the SSLCertificateChainFile is actually deprecated and it is not being used at all.

Vert.x on the other side does use the chain.pem file. It returns only the intermediate cert and wget complains because of that. To fix the issue create a fullchain.pem file composed of both the chain.pem and the cert.pem files, e.g.,

cat cert.pem chain.pem > fullchain.pem

Then use the fullchain.pem with the PemTrustOptions configuration.

You don't need to put the LE root certificate in the fullchain.pem file, because it should already be present on both client and server side. Here's an excerpt from the TLS Protocol RFC about it.

certificate_list This is a sequence (chain) of certificates. The sender's certificate MUST come first in the list. Each following certificate MUST directly certify the one preceding it. Because certificate validation requires that root keys be distributed independently, the self-signed certificate that specifies the root certificate authority MAY be omitted from the chain, under the assumption that the remote end must already possess it in order to validate it in any case.

Upvotes: 0

Related Questions