3

I am new on encryptation world, and reading about this, mostly websites say to use the prime256v1 for better performance and security.

After some days testing, finally I get my openssl CA structure working, almost steps come from this guide:

FreeBSD Certificate Authority

I have did some changes, like search for OIDs (just adding same OIDs from permissions, example in CAs I have added 2.5.29.19, etc...)

Already have setup my CRL distribution points too, everything is working (at least seems be working) nice.

The problem occours if I change the final certificate structure from the guide, so for example, instead make an TLS Server Certificate using the following 3 steps from guide:

Generate PK

/usr/local/bin/openssl genpkey \
    -aes-256-cbc \
    -algorithm RSA \
    -pkeyopt 'rsa_keygen_bits:4096' \
    -out private/srv.example.org.key.enc \
    -pass file:private/srv.example.org.pwd

Generate Certificate Request

setenv SAN "DNS:srv.example.org"
/usr/local/bin/openssl req \
    -config etc/tls-server.conf \
    -new \
    -sha512 \
    -out certs/srv.example.org.csr \
    -key private/srv.example.org.key.enc \
    -subj /C=DE/ST=State/L=Locality/O=Example\ Corporation/OU=System\ Administration/CN=srv.example.org \
    -passin file:private/srv.example.org.pwd
unsetenv SAN

Sign the certificate

/usr/local/bin/openssl ca \
    -config etc/component-ca.conf \
    -batch \
    -md sha512 \
    -in certs/srv.example.org.csr \
    -out certs/srv.example.org.crt \
    -extensions server_ext \
    -startdate `date -j -u '+%Y%m01000000Z'` \
    -enddate `date -j -u -v+2y '+%Y%m01000000Z'` \
    -passin file:ca/component-ca/private/component-ca.pwd

For test an prime256v1, I have did:

Generate PK (testing prime256v1)

/usr/local/bin/openssl genpkey \
    ecparam \
    -name prime256v1 \
    -genkey \
    -param_enc explicit \
    -out private/srv.example.org.key \

Generate Certificate Request (testing prime256v1)

setenv SAN "DNS:srv.example.org"
/usr/local/bin/openssl req \
    -new \
    -sha512 \
    -config etc/tls-server.conf \
    -key private/srv.example.org.key.enc \
    -nodes \
    -out certs/srv.example.org.csr \
    -subj /C=DE/ST=State/L=Locality/O=Example\ Corporation/OU=System\ Administration/CN=srv.example.org \
unsetenv SAN

Sign the certificate (testing prime256v1)

/usr/local/bin/openssl ca \
    -config etc/component-ca.conf \
    -batch \
    -md sha512 \
    -in certs/srv.example.org.csr \
    -out certs/srv.example.org.crt \
    -extensions server_ext \
    -startdate `date -j -u '+%Y%m01000000Z'` \
    -enddate `date -j -u -v+2y '+%Y%m01000000Z'` \
    -passin file:ca/component-ca/private/component-ca.pwd

The certificate is signed without erros...

When I try acesss my domain browsers block the access saying the error:

No Cypher Overlap

My first guess is because the mix of encryption, then I have changed entire commands from the guide to make Root-CA, Network-CA, Component-CA all using secp521r1, since seems be an good security practice use hightest encryption on top and low encryption (prime256v1) on botton for make compatibility...

And then, same error occours:

No Cypher Overlap

So if I wish use prime256v1 I need make all structure with only it? If tomorrow this process become weak, I need remade entire CA with new security encryption (eg, secp384r1)?

On Server side I have used the Mozilla SSL Configuration Generator to setup:

SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 SSL

CipherSuite
ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256

PS.: I have no plans to purchase an online SSL Validated Certificate, but I will love have an working CA testing structure working for study.

  • This is probably a configuration issue with your (unknown) server. When you try to use ECC key in a certificate you need to have ECDSA ciphers enabled at the server. – Steffen Ullrich May 9 '16 at 4:49
  • They are on server, for configure my apache I used the values: SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 All default from the firefox tool: Mozilla SSL Configuration Generator (Gonna update the main post). – Wisdown May 9 '16 at 5:34
  • I have tested using on apache: SSLCipherSuite ALL:!aNULL:RC4+RSA:+HIGH:+MEDIUM:+LOW:+EXP:+eNULL and SSLProtocol all I get an new error: SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT – Wisdown May 11 '16 at 6:27
  • Unfortunately these are all just information snippets which reflect different stages of your tests. It is impossible to rebuild your problem based on these information. I recommend that you look into the server log files for more information. If this does not help please provide a minimal but working setup so that others can exactly reproduce your problem. – Steffen Ullrich May 11 '16 at 9:17
  • Thanks for the reply Steffen, would you be more specific about what to search in logs? I already have tried look inside and dont found any info, maybe I need use an specific log format. The exact setup is the one from the guide, the only change is the cipher suite from Mozzila SSL Configuration Generator and the Certified Sign request, changing from usually RSA to prime256v1, testing on SSL Labs says is ok, but the page never load, still blank ever. On RSA setup there an extra setup for remove encryption of the Key, I haven't did it on prime256v1 because not found in guides info to it. – Wisdown May 14 '16 at 13:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.