quatermain
2-way-ssl (Mutual TLS) with HTTPoison and Hackney
Hello,
I have to do requests to some APIs with 2-way-ssl, so every request has to by signed with our cert and private key. We uploaded our certificate to 3rd party servers which provide these APIs.
We put this options into HTTPoison call:
[{:Certificate, cert_der, :not_encrypted}] =
File.read!("/cert/cert.pem") |> :public_key.pem_decode()
key = File.read!("/cert/key.pem") |> :public_key.pem_decode() |> hd |> Tuple.delete_at(2)
[
ssl: [
versions: [:"tlsv1.2"],
verify: :verify_peer,
cacertfile: CAStore.file_path(),
cert: cert_der,
key: key,
depth: 3,
customize_hostname_check: [
match_fun: :public_key.pkix_verify_hostname_match_fun(:https)
]
]
]
When we do request, it looks like server doesn’t know how to process it. Because their api should response error in json format and we got only this:
<html>\n<body>\n<h1>Fault</h1>env:Receiverfault:MessageBlocked</body>\n</html>\n
I tried make request with Postman (NodeJS) with same certificate and private key and it works without problem.
Any ideas where can be problem? I asked on slack and @voltone gave me some good advice but I’m a little bit lost and looks like I did something wrong.
Thanks for any help or suggeston
Trending in Questions
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Producing high quality Elixir screencasts since 2017.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #elixirconf-us
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #metaprogramming
- #performance
- #security
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Practical resources that improve the lives of professional developers.
Develop your skills with books, videos, and courses.
Bringing learning, work and compliance together since 1987.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Marked As Solved
quatermain
So we fixed it. We did this:
changed this:
to this:
This ssl setup with RSA private key:
and the most important part in our mix file:
Thanks everybody
Also Liked
quatermain
we had to fix it. I didn’t want to change language and it’s for our new product for PSD2 application. Currently we are first in country with license and a lot of customers ask for it for last year. So we have big line of customers waiting for it. Big thanks for community which help us a lot.
voltone
Hmm, so in that case it wouldn’t be an issue of missing intermediates.
The server’s response is not very helpful. If you make a request without client certificate at all, does the server throw a TLS alert, or do you get the same HTML error? I’m trying to understand whether the server is configured to handle mutual TLS auth issues at a higher protocol layer. Most (but not all) servers would reply with a TLS alert. Maybe everything is fine on the TLS layer, and you have a missing HTTP header (“Accept: application/json” ?).
There isn’t anything to try here if you do not have any intermediate CA certificates…
quatermain
You are the winner. Their API documentation and Sandbox API use for all api calls “application/x-www-form-urlencoded” and their Production API use “application/json” but only for auth api call. Others look like use www-form.
FYI - API owner is group of banks, about 7 countries and 7 banks in EU. So… I will write horror/comedy book after all my NDA will end.
Last Post!
ityonemo
Perfect project for a junior!