CODEWITHSUNDEEP
sslwebsocketrust
lblenner
lblenner

Reputation: 452

SSL implementation with Tungstenite: SSL alert number 42

I created a working WebSocket server with async_tungstenite and async_std.

I now want to add SSL using async_native_tls.

If I understood correctly, this crates provides a function accept which takes a TcpStream, handles the TLS handshake and provides a TlsStream<TcpStream> which should behave like a TcpStream but handles the encryption and decryption behind the scene.

To test the server, I created a self-signed certificate.

Based on that, here is how the code handling new TCP connections evolved:

async fn accept_connection(stream: TcpStream, addr: SocketAddr) {
    //Websocket stream
    let accept_resut = async_tungstenite::accept_async(stream).await;

    if let Err(err) = accept_resut {
        println!(
            "Error while trying to accept websocket: {}",
            err.to_string()
        );
        panic!(err);
    }

    println!("New web socket: {}", addr);
}

async fn accept_connection(stream: TcpStream, addr: SocketAddr) {
    //Open tls certificate !should be done one time and not for each connection!
    let file = File::open("identity.pfx").await.unwrap();
    let acceptor_result = TlsAcceptor::new(file, "glacon").await;

    if let Err(err) = acceptor_result {
        println!("Error while opening certificate: {}", err.to_string());
        panic!(err);
    }

    let acceptor = acceptor_result.unwrap();

    //Get a stream where tls is handled
    let tls_stream_result = acceptor.accept(stream).await;

    if let Err(err) = tls_stream_result {
        println!("Error during tls handshake: {}", err.to_string());
        panic!(err);
    }

    let tls_stream = tls_stream_result.unwrap();

    //Websocket stream
    let accept_resut = async_tungstenite::accept_async(tls_stream).await;

    if let Err(err) = accept_resut {
        println!(
            "Error while trying to accept websocket: {}",
            err.to_string()
        );
        panic!(err);
    }

    println!("New web socket: {}", addr);
}

With this implementation, I now call from a webpage

const sock = new WebSocket('wss://localhost:8020');

This results in the error:

Error while trying to accept websocket: 
IO error: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate:../ssl/record/rec_layer_s3.c:1543:SSL alert number 42
thread 'async-std/runtime' panicked at 'Box<Any>', src/main.rs:57:9

It seems like the handshake was successful as the error does not occur during the acceptor.accept. The error states that the certificate is not valid so here is how I created my self-signed certificate.
The openssl version is 1.1.1f

# Create a key
openssl req -nodes -new -key server.key -out server.csr
# Create the self-signed certificate
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
# Convert the certificate to pfx format
openssl pkcs12 -export -out identity.pfx -inkey server.key -in server.crt

I thought that this problem had to do with security feature from the browser as the "SSL alert number 42" seems to come from the client. I tried to disable this option in Firefox settings

Query OCSP responder servers to confirm the current validity of certificates

I also tried to add my server.crt to the Authorities of the certificate manager.

Neither of these worked.

Upvotes: 1

Views: 2049

Answers (1)

lblenner
lblenner

Reputation: 452

The problem came from the security features of Firefox.
Firefox detects that the certificate is not signed by an authority and sends back an error.
It seems like adding the certificate to the known authorities does not work.

To avoid this issue, I found this thread which indicates that an exception should be added for the address and port of your development Websocket server.

Go to Settings > Certificates > View Certificates > Servers > Add Exception...
Type in your local server (for me localhost:8020).
Add exception.

Upvotes: 1

Related Questions