Certificates for esp8266 iotsa devices considered "too weak"

[jackjansen]

Iotsa devices cannot be connected to anymore.

Attempting curl gives

curl: (60) SSL certificate problem: EE certificate key too weak

I don't think increasing the number of key bits (currently 512) is an option for the esp8266, but need to investigate.

Otherwise we have to check whether there is a workaround (by allowing weaker keys in the plugins for the devices).

But first we need to investigate that this is indeed the problem...

[jackjansen]

Indeed, that does seem to be the problem. The following command doesn't work (but gives an unrelated error message):

curl --ciphers DEFAULT@SECLEVEL=1 https://smartmeter.local/p1?format=json

There's interesting reading at https://serverfault.com/questions/1033354/how-to-diagnose-ca-certificate-too-weak-error-how-to-use-the-ca-cert-anyway

[jackjansen]

The quick fix: use openssl version -d to find the config directory. Edit the openssl.cnf file there. Set CipherString = DEFAULT@SECLEVEL=1 (probably near the end). Sigh.