Trying to create cert for RSA and Not ECDH

Question

I have an old application that needs the obsolete RSA key and not the ECDH. I know the ECDH is newer. I have tried this

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private-key.pem

I create my csr

I import the csr in CA to create cer and the chain. After doing all this I still get the new version of the ssl cert.

The connection to this site is encrypted and authenticated using TLS 1.2, ECDHE_RSA with P-256, and AES_128_GCM

I want this:

The connection to this site is encrypted and authenticated using TLS1.2, RSA, and AES_256_CBC with HMAC-SHA1

The application servers are Windows.

Answer 1

You got this: TLS 1.2, ECDHE_RSA with P-256, and AES_128_GCM, but you wanted: TLS1.2, RSA, and AES_256_CBC with HMAC-SHA1

There are two different but related things here: the algorithm in your certificate, and the configuration of your TLS server.

So you made yourself an RSA signing certificate, and you configured your TLS to offer cipher suites with ECDHE key exchange and RSA signature. You are looking for a cipher suite that does RSA key exchange, which is probably not going to work with the certificate you created.

I won't do all the work for you, but I'll give some pointers: first, to get a certificate that can work with RSA key exchangeyou'll need a certificate with keyUsage = keyEncipherment. Check the cert you have; I would bet it's keyUsage = digitalSignature, in which case you'll need to edit your openssl ca config file to list (see this article)

keyUsage   = critical, keyEncipherment

and then you'll need to edit your openssl tls settings to add the RSA key agreement ciphers (see the openssl man page). Good luck!