Intermediate certs don't work with SNICallback

If I give key, cert and ca via options field to https.createServer the whole key chain is returned on connection (correct behaviour). If I try to do the same via SNICallback it is not possible to set whole key chain.

Example code:

var https = require("https");
var fs = require("fs");
var tls = require("tls");

var o = {
    key: fs.readFileSync("example.com.key"),
    cert: fs.readFileSync("example.com.crt"),
    ca: fs.readFileSync("intermediate.crt")
};

var context = tls.createSecureContext(o);
var options = {
    SNICallback: function(servername, cb) {
        return cb(null, context);
    },

    ca: o.ca
};

https.createServer(options, function(req, res) {
    res.writeHead(200);
    res.end("hello world\n");
}).listen(8000);

Now try to connect via openssl:

openssl s_client -servername example.com -connect localhost:8000

Expected and real behaviour is Verify return code: 0 (OK).

If I remove the ca in options map like this

var options = {
    SNICallback: function(servername, cb) {
        return cb(null, context);
    }
};

and rerun openssl client the return code is Verify return code: 21 (unable to verify the first certificate)which indicates that not the whole key chain is returned.
The expected behaviour is Verify return code: 0 (OK) as the ca field is given to tls.createSecureContext.

This occures in io.js 3.x and Node.js 4.0.0.

+1 - I've just hit the same issue.

/cc @nodejs/crypto

Would concatenating those intermediate certificates alongside your cert instead of ca works in this case?

It should work. Working on fix.

@alexlamsl

@alexlamsl did you mean something like

var o = {
  key: fs.readFileSync("example.com.key"),
  ca: fs.readFileSync("example.com.crt") + "\n" + fs.readFileSync("intermediate.crt")
};

@fastner

@fastner I just did it on the crt file itself:

-----BEGIN CERTIFICATE----- 
 (Your Primary SSL certificate: example.com.crt) 
-----END CERTIFICATE-----  
-----BEGIN CERTIFICATE----- 
 (Your Intermediate certificate: intermediate.crt) 
-----END CERTIFICATE-----

And then specify only cert and no ca in the options.

@alexlamsl

@alexlamsl Your solution to concatenate cert and intermediates works well - thanks for the solution.

tls: copy client CAs and cert store on CertCb

Maybe it's a dumb question or the wrong place to ask, but is the cert: cert+'\n'+ca workaround safe to use or do I have to be afraid that this causes trouble with future node versions?

Navigation Menu

Repository navigation

Intermediate certs don't work with SNICallback #2772

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Intermediate certs don't work with SNICallback #2772

Description

Activity

gregholland commented on Oct 24, 2015

bnoordhuis commented on Oct 25, 2015

alexlamsl commented on Oct 25, 2015

indutny commented on Oct 25, 2015

fastner commented on Oct 25, 2015

alexlamsl commented on Oct 25, 2015

gregholland commented on Oct 27, 2015

anatolsommer commented on Mar 13, 2016

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions