-
Notifications
You must be signed in to change notification settings - Fork 3k
Description
Describe the bug
TLS handshake crashed with
{ssl_error,{tls_alert,{internal_error,"TLS server: In state certify at ssl_handshake.erl:372
The line number is from OTP-23.2.7, but I tested OTP-24 too, same crash.
After I added a debug printout for the stacktrace, I got this:
[{ssl_cipher,scheme_to_components,
[ecdsa_secp512r1_sha512],
[{file,"ssl_cipher.erl"},{line,980}]},
{ssl_certificate,is_supported_signature_algorithm,2,
[{file,"ssl_certificate.erl"},{line,427}]},
{ssl_certificate,validate,3,[{file,"ssl_certificate.erl"},{line,157}]},
{pubkey_cert,verify_fun,4,[{file,"pubkey_cert.erl"},{line,355}]},
{public_key,validate,2,[{file,"public_key.erl"},{line,1478}]},
{public_key,path_validation,2,[{file,"public_key.erl"},{line,1417}]},
{ssl_handshake,certify,9,[{file,"lib/ssl/src/ssl_handshake.erl"},{line,360}]},
{tls_dtls_connection,certify,3,
[{file,"tls_dtls_connection.erl"},{line,349}]}]
To Reproduce
I have generated some certificates to reproduce it, the are committed in this repo:
https://github.com/zmstone/erlang-tls-test
clone this repo, execute ./run.sh server in one console and execute ./run.sh client in another.
Expected behavior
Successful TLS handshake or at least a sensible error message if the algorithm is not supported.
Affected versions
OTP23, 24, I did not check earlier versions, probably the same.
Additional context
Most likely just a typo: ecdsa_secp512r1_sha512 -> ecdsa_secp521r1_sha512.
I tried to fix the typo to verify, it works fine after the fix.