ngscheurich
Anyone here have experience with getting mutual TLS authentication working with an Elixir HTTP client?I have a CA file, certificate, and private key that work in a few other contexts with the request am trying to make:
- In Postman, using the built-in “Certificates” feature
- With curl, using
--capath,--cert, and--key - In Node.js, using the request-promise library
In terms of Elixir, I’ve tried with HTTPoison and Mint, setting the :ssl and :transport_opts options, respectively, to:
[
certfile: @certfile,
keyfile: @keyfile,
cacertfile: @cacertfile
]
Mint times out on connect/4 and HTTPoison sends the request, which the server rejects.The relevant information I can extract from the 400 response that HTTPoison gets me is “400 The SSL certificate error”—not very helpful. I’ve reached out to the support team for the API I am working with, but I was hoping you folks might have some insight in the interim.
Thanks in advance!
Where Next?
Trending in Questions
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Producing high quality Elixir screencasts since 2017.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #blog-post
- #ai
- #elixirconf-us
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #hex
- #security
- #metaprogramming
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Practical resources that improve the lives of professional developers.
Bringing learning, work and compliance together since 1987.
Enabling companies to succeed by building software people love.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 3- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
tangui
Maybe you can give a try with
:httpc, after setting theverboseoption ofset_options/1to one ofverbose,debugortrace. You should get detailed log messages.You can look in APIacAuthMTLS tests how to use it.
Meanwhile, are you using the public X509 infrastructure at both ends, or privately generated certs? In the latter case, are you sure they’ve added your cert (or cert root) to their CA file?
ngscheurich
Thanks for the tip, @tangui—I’ll have a go with verbose
:httpcand report back.The cert I’m testing with is a Let’s Encrypt certificate generated with certbot, so I think I’m okay as far as having a known CA, especially given the fact that the request works using other HTTP tools, e.g. curl.
davemenninger
I’ve gotten it to work with HTTPoison, something like this: