Hmm, just to rule out file encoding issues altogether, when you run :public_key.pem_decode(File.read!("cert.pem")) in iEX, do you get a list with one or two certificates?
voltone
0
CharlesO
I have adjusted like you suggested.
-----BEGIN CERTIFICATE-----
MIIGiTCCBXGgAwIBAgISBJEvL3uT8YZMvG0HGiFugEe9MA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
EwJSMzAeFw0yMTAyMDUxMTAyNTNaFw0yMTA1MDYxMTAyNTNaMCsxKTAnBgNVBAMT
IHd3dy5wYXBlcmxlc3Nzb2x1dGlvbnNsdGQuY29tLm5nMIICIjANBgkqhkiG9w0B
AQEFAAOCAg8AMIICCgKCAgEA/pJFz2InXO8UiTggt3ThP3tiIiipVWfGzteHLI7S
6VhJRjv+/W+Mcu5EXXdVum/1ZTe6E1Ko/i0qrqvwvBNhuCCI0EnK5H299jAICt0/
JnSTDp1JDz2k7Nm0MIiIEZfvaIRXuoopR4iM91svIku6D3rzZ+OwoTUvZXvEscky
pBJc+fVUJvfnGhDwLqLXvXyzXqapKphrGxAAHD2GzxOEGo33N3N97m18qbyeG+hA
UOcIRVfLP2jPrWDolKchtM9AyUj4lAiMsPU7Jc+Rt6AnMyTr1hsXduUCNNn3i/h/
s7Kg3xIo++izDhC9Qj5Pedgy2pbZ6z4ZMKQ9UsPGHJ6X3BmT7lgX796nGeaySC+L
HqwBtoAlFMwE96i4yNEhFlQuM5roNhlVc4Vv5yyvtVNtxoYMGpsrJ0upAWHmJ+0J
UJVlCcemng+7eSfNBrdZ1XvSvHxSqPEOmmn7gqdBzad3PKj9inkibtmSqt9gNOGR
RzI0DZK8CE52LUrqBNrUsifmE8uw/FQ11+7eahL65b0nNj0wreExONb0aQEYOR1/
/4YXK742K3l4hZn5r/sIuzgYFFIZwIKckYi821EHE3ugwPG3asBXBaZ9vSZ5CFt+
vAzedpTNV3nN/55KlqHhll98FF6JQAFNsGRY5kcWC2SVv/KRIczrfVm2R/USVXOX
iWcCAwEAAaOCAp4wggKaMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEF
BQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUnReY/FdZAB8x
NTbPm+A1kBqwgAYwHwYDVR0jBBgwFoAUFC6zF7dYVsuuUAlA5h+vnYsUwsYwVQYI
KwYBBQUHAQEESTBHMCEGCCsGAQUFBzABhhVodHRwOi8vcjMuby5sZW5jci5vcmcw
IgYIKwYBBQUHMAKGFmh0dHA6Ly9yMy5pLmxlbmNyLm9yZy8wbAYDVR0RBGUwY4Ih
bWFpbC5wYXBlcmxlc3Nzb2x1dGlvbnNsdGQuY29tLm5nghxwYXBlcmxlc3Nzb2x1
dGlvbnNsdGQuY29tLm5ngiB3d3cucGFwZXJsZXNzc29sdXRpb25zbHRkLmNvbS5u
ZzBMBgNVHSAERTBDMAgGBmeBDAECATA3BgsrBgEEAYLfEwEBATAoMCYGCCsGAQUF
BwIBFhpodHRwOi8vY3BzLmxldHNlbmNyeXB0Lm9yZzCCAQYGCisGAQQB1nkCBAIE
gfcEgfQA8gB3AESUZS6w7s6vxEAH2Kj+KMDa5oK+2MsxtT/TM5a1toGoAAABd3IS
1lkAAAQDAEgwRgIhAODIbmogAX5fAQ8pKfAlEbZMFJYqksp3iInqCepNymN3AiEA
zdJOaSOHe2A78x9thbdf8WCndV/rPVLw0tME6hzpW6QAdwD2XJQv0XcwIhRUGAgw
lFaO400TGTO/3wwvIAvMTvFk4wAAAXdyEtZZAAAEAwBIMEYCIQD8FomGRVUtXy5e
XByxhM383UUKt+35L217GUAZ7FUgjwIhANrw1gax+fOWp6qRLpBFDz7S3D9SL5RA
KHWQYOJmM8ciMA0GCSqGSIb3DQEBCwUAA4IBAQCU1EzS7Lt1hAZ4+WtPisM+B8R/
RKJ72PTE+E8dHB+SlNeFoJGpj5Z4FO9bp69fdOcG6D2NxJBDVc1VCR7Gx20Sxngs
wm9CexnRlsRaWuXLTJoxn/QoQ+kEWRIIYVXaa7MmlkljpTGLHkBHpwOT7/rtmgpB
geUmgjia+hlah2jltYP6QwhXriOXuhUU/DltAm8S2yS8ITtIIe/0yCXy3CilY7Um
0qtQW5lDecCqZtYlBGwNtoJbAWJrAnlMavdlM6Z1ziRh33BiPQXKNFfBk2P9kBmA
Yud7vIIOK5SB5KhZ45WWm2Tmu2ZsHPu+iaDR+rQB68BOi1aQY0P6+JbY6V1j
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw
WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
RW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cP
R5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdx
sxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8Zutm
NHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxg
Z3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG
/kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC
AYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB
Af8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaA
FHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw
AoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw
Oi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB
gt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6W
PTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wl
ikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQz
CkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BIm
lJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4
avAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2
yJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1O
yK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90Ids
hCExroL1+7mryIk
XPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+
HlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6Zv
MldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqX
nLRbwHOoq7hHwg==
-----END CERTIFICATE-----
same result.
0
voltone
Could it be the line break between the two certificates is not a newline, but maybe CR or a space? Try opening the file and adding one or more new lines just before “-----BEGIN CERTIFICATE-----”.
0
CharlesO
voltone
Can you share the contents of your cert.pem file?
Unlike many other servers, Erlang/OTP’s ssl does not blindly copy the contents of the file into the TLS handshake. Instead, it inspects the end certificate and then looks for its issuer certificate (recursively) using the available CA certificates. If you specify the :cacertfile/:cacerts option, then it will look for the intermediates there, rather than in the file :certfile points to. Of you don’t, then it falls back to looking in :certfile for the intermediates.
It sounds like in your case this process does not result in a valid issuer for your end certificate, so none is sent in the handshake. The question is why exactly…
0
CharlesO
I have obtained the full-chain.pem by combining both my cert.pem and the intermediate cert from lets-encrypt.
The result is still the same.
0
voltone
The cert.pem file from Let’s Encrypt contains only the end certificate. You should also have a file called fullchain.pem containing the end certificate and any associated intermediates. If you point the :certfile option to the fullchain.pem file, your server should send those intermediates in the handshake.
(There are some more subtleties, but in most cases this should be enough to get going)
0
CharlesO
openssl s_client -connect paperlesssolutionsltd.com.ng:8443
gives:
λ openssl s_client -connect paperlesssolutionsltd.com.ng:8443
CONNECTED(000001B8)
depth=0 CN = www.paperlesssolutionsltd.com.ng
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = www.paperlesssolutionsltd.com.ng
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
0 s:CN = www.paperlesssolutionsltd.com.ng
i:C = US, O = Let's Encrypt, CN = R3
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIGiTCCBXGgAwIBAgISBJEvL3uT8YZMvG0HGiFugEe9MA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
EwJSMzAeFw0yMTAyMDUxMTAyNTNaFw0yMTA1MDYxMTAyNTNaMCsxKTAnBgNVBAMT
IHd3dy5wYXBlcmxlc3Nzb2x1dGlvbnNsdGQuY29tLm5nMIICIjANBgkqhkiG9w0B
AQEFAAOCAg8AMIICCgKCAgEA/pJFz2InXO8UiTggt3ThP3tiIiipVWfGzteHLI7S
6VhJRjv+/W+Mcu5EXXdVum/1ZTe6E1Ko/i0qrqvwvBNhuCCI0EnK5H299jAICt0/
JnSTDp1JDz2k7Nm0MIiIEZfvaIRXuoopR4iM91svIku6D3rzZ+OwoTUvZXvEscky
pBJc+fVUJvfnGhDwLqLXvXyzXqapKphrGxAAHD2GzxOEGo33N3N97m18qbyeG+hA
UOcIRVfLP2jPrWDolKchtM9AyUj4lAiMsPU7Jc+Rt6AnMyTr1hsXduUCNNn3i/h/
s7Kg3xIo++izDhC9Qj5Pedgy2pbZ6z4ZMKQ9UsPGHJ6X3BmT7lgX796nGeaySC+L
HqwBtoAlFMwE96i4yNEhFlQuM5roNhlVc4Vv5yyvtVNtxoYMGpsrJ0upAWHmJ+0J
UJVlCcemng+7eSfNBrdZ1XvSvHxSqPEOmmn7gqdBzad3PKj9inkibtmSqt9gNOGR
RzI0DZK8CE52LUrqBNrUsifmE8uw/FQ11+7eahL65b0nNj0wreExONb0aQEYOR1/
/4YXK742K3l4hZn5r/sIuzgYFFIZwIKckYi821EHE3ugwPG3asBXBaZ9vSZ5CFt+
vAzedpTNV3nN/55KlqHhll98FF6JQAFNsGRY5kcWC2SVv/KRIczrfVm2R/USVXOX
iWcCAwEAAaOCAp4wggKaMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEF
BQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUnReY/FdZAB8x
NTbPm+A1kBqwgAYwHwYDVR0jBBgwFoAUFC6zF7dYVsuuUAlA5h+vnYsUwsYwVQYI
KwYBBQUHAQEESTBHMCEGCCsGAQUFBzABhhVodHRwOi8vcjMuby5sZW5jci5vcmcw
IgYIKwYBBQUHMAKGFmh0dHA6Ly9yMy5pLmxlbmNyLm9yZy8wbAYDVR0RBGUwY4Ih
bWFpbC5wYXBlcmxlc3Nzb2x1dGlvbnNsdGQuY29tLm5nghxwYXBlcmxlc3Nzb2x1
dGlvbnNsdGQuY29tLm5ngiB3d3cucGFwZXJsZXNzc29sdXRpb25zbHRkLmNvbS5u
ZzBMBgNVHSAERTBDMAgGBmeBDAECATA3BgsrBgEEAYLfEwEBATAoMCYGCCsGAQUF
BwIBFhpodHRwOi8vY3BzLmxldHNlbmNyeXB0Lm9yZzCCAQYGCisGAQQB1nkCBAIE
gfcEgfQA8gB3AESUZS6w7s6vxEAH2Kj+KMDa5oK+2MsxtT/TM5a1toGoAAABd3IS
1lkAAAQDAEgwRgIhAODIbmogAX5fAQ8pKfAlEbZMFJYqksp3iInqCepNymN3AiEA
zdJOaSOHe2A78x9thbdf8WCndV/rPVLw0tME6hzpW6QAdwD2XJQv0XcwIhRUGAgw
lFaO400TGTO/3wwvIAvMTvFk4wAAAXdyEtZZAAAEAwBIMEYCIQD8FomGRVUtXy5e
XByxhM383UUKt+35L217GUAZ7FUgjwIhANrw1gax+fOWp6qRLpBFDz7S3D9SL5RA
KHWQYOJmM8ciMA0GCSqGSIb3DQEBCwUAA4IBAQCU1EzS7Lt1hAZ4+WtPisM+B8R/
RKJ72PTE+E8dHB+SlNeFoJGpj5Z4FO9bp69fdOcG6D2NxJBDVc1VCR7Gx20Sxngs
wm9CexnRlsRaWuXLTJoxn/QoQ+kEWRIIYVXaa7MmlkljpTGLHkBHpwOT7/rtmgpB
geUmgjia+hlah2jltYP6QwhXriOXuhUU/DltAm8S2yS8ITtIIe/0yCXy3CilY7Um
0qtQW5lDecCqZtYlBGwNtoJbAWJrAnlMavdlM6Z1ziRh33BiPQXKNFfBk2P9kBmA
Yud7vIIOK5SB5KhZ45WWm2Tmu2ZsHPu+iaDR+rQB68BOi1aQY0P6+JbY6V1j
-----END CERTIFICATE-----
subject=CN = www.paperlesssolutionsltd.com.ng
issuer=C = US, O = Let's Encrypt, CN = R3
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 2489 bytes and written 410 bytes
Verification error: unable to verify the first certificate
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 4096 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 21 (unable to verify the first certificate)
---
HTTP/1.1 400 Bad Request
connection: close
content-type: text/plain
content-length: 19
Invalid line:
closed
c:\Projects
λ
The intermediate certs are not being sent. Please is there aa config needed for erlang ssl to send the intermediate certs?
I have tried both Elli and Ace servers
0
CharlesO
Hi, I have tried most of these but i still get this error here:
https://stackoverflow.com/questions/66076678/setting-up-ssl-correctly-on-an-erlang-elixir-server.
Any help please.
1
brundozer
In case anyone comes across this post like I did, and wonders what the minimal config would be as of July 2020 to get an A+ on both SSL Labs and ImmuniwebSSL (htbridge) using a Let’s Encrypt certificate, here it is:
https: [
port: System.get_env("HTTPS_PORT"),
keyfile: System.get_env("TLS_KEY_FILE"),
certfile: System.get_env("TLS_CERT_FILE"),
dhfile: "/etc/ssl/dhparam.pem",
cipher_suite: :strong,
client_renegotiation: false,
transport_options: [socket_opts: [:inet6]]
]
The TLS_KEY_FILE being the privkey.pem and the TLS_CERT_FILE the fullchain.pem that are generated by certbot.
1