0

My purpose is to leverage DH algorithm to enhance self-signed certificate (A toy in local computer).

I refered the answer of Matt Caswell. It works fine to generate the dhcert.pem but fail to configure nginx OpenSSL generates DS-RSA key

I match the dhcert.pem with ssl_certificate entry and the dhkey.pem with ssl_certificate_key entry. However, with 'nginx -t' checker, it says

SSL: error:140BF0F7:SSL routines:ssl_set_cert:unknown certificate type

I've already set the dhparam in the nginx configuration file as well. I don't know what causes the problem.

Also, I accept almost all the cipher:

ssl_prefer_server_ciphers on;

ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK';

Improve this question

1 Answer 1

Reset to default
1

OpenSSL removed support for DH certificates in libssl starting with OpenSSL 1.1.0. You can still create the certificates, but you can't use them in a TLS connection. In order to do so you would have to use an earlier version of OpenSSL (none of which are currently supported by the project). You would need OpenSSL 1.0.2 or earlier.

Improve this answer
4
  • Much thanks. That's should be the reason. My VM is ubuntu20.04 which has a version of OpenSSL of 1.1.1.
    – Jiawei Cao
    Jun 24, 2021 at 13:32
  • What's more, in my experiment with v1.1.1, it seems the ECDH can work with nginx configuration. I'm a beginner of it and so... just find it interesting. I think ECDH should have a similar functionality with DH
    – Jiawei Cao
    Jun 24, 2021 at 13:35
  • 1
    A certificate can have an EC public key in it. Such a public key can be used for ECDH (a key exchange algorithm) or ECDSA (a signature algorithm). Current versions of OpenSSL fully support ECDSA based ciphersuites. They do not support static ECDH based ciphersuites. You can install an EC based certificate in OpenSSL 1.1.1 and it will work - but it won't be doing static ECDH. It will end up doing ephemeral ECDH with ECDSA signatures.
    – Matt Caswell
    Jun 24, 2021 at 14:39
  • Actually 1.0.2 only; 1.0.1 and 1.0.0 supported static-ECDH suites but not static-(integer)DH, and the same for 0.9.8 iff you manually enabled ECC. (As I commented on The Bear's answer to #44251.)
    – dave_thompson_085
    May 22 at 0:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .