2-way-ssl (Mutual TLS) with HTTPoison and Hackney

Maybe try using the certfile and keyfile (instead of cert and key) options instead of decoding them yourself

Also check this out: Adding more SSL options for client certificates (Mutual TLS) · Issue #587 · benoitc/hackney · GitHub

I was thinking about the same root cause: missing intermediate certificates for the client cert. But in that case I would expect the ‘cert.pem’ file to contain more than one certificate, and that would cause the pattern match on the first line to fail.

@quatermain are these the exact files you used with Postman? Or is there another file with additional CA certificates to go with your client certificate?

See also my reply in this thread.

These files are same as in Postman

I tried, same response.

I will try this and others tomorrow. It’s too late now here. Thanks guys

Hmm, so in that case it wouldn’t be an issue of missing intermediates.

The server’s response is not very helpful. If you make a request without client certificate at all, does the server throw a TLS alert, or do you get the same HTML error? I’m trying to understand whether the server is configured to handle mutual TLS auth issues at a higher protocol layer. Most (but not all) servers would reply with a TLS alert. Maybe everything is fine on the TLS layer, and you have a missing HTTP header (“Accept: application/json” ?).

There isn’t anything to try here if you do not have any intermediate CA certificates…

Also you may try with curl, setting verbosity level to its maximum (-v) to determine:

• if TLS client authentication is optional or disabled
• if TLS client authentication actually happens
• if not (which means TLS client authentication is optional), why it fails

Feel free to post it here, it’s usually quite informative. Beware before posting results here, I’m don’t remember whether the debug messages contain the private key or not.

You are the winner. Their API documentation and Sandbox API use for all api calls “application/x-www-form-urlencoded” and their Production API use “application/json” but only for auth api call. Others look like use www-form.

FYI - API owner is group of banks, about 7 countries and 7 banks in EU. So… I will write horror/comedy book after all my NDA will end.

Update: not done, I got json response with message ID and status code 400, no other information. I thought it’s working because I need id from this response. But I need consent id and not message id. But it looks like problem with their system. Not sure where can be problem when I got error with:

env:Receiverfault:MessageBlocked

or another error with message id.

So this pain is still there and I will have to resolve it ASAP . I contacted support last week so I hope they will get us something this week.

Thanks guys

Update: support gave answer. Sandbox api use another API than production. We got new documentation for production API, so we have to update our code and test it on production.

another update. We tried API of another Bank, where has to be same (hope so) Mutual TLS and we got:

[info] TLS client: In state cipher received SERVER ALERT: Fatal - Handshake Failure

and

 ** (OAuth2.Error) {:tls_alert, {:handshake_failure, 'received SERVER ALERT: Fatal - Handshake Failure'}}

with this setup:

[
      ssl: [
        versions: [:"tlsv1.2"],
        verify: :verify_peer,
        cacertfile: CAStore.file_path(), #"/app/lib/castore-0.1.5/priv/cacerts.pem"
        certfile: "/cert/cert.pem",
        keyfile: "/cert/key.pem",
        depth: 3,
        customize_hostname_check: [
          match_fun: :public_key.pkix_verify_hostname_match_fun(:https)
        ]
      ]
    ]