0

My purpose is to leverage DH algorithm to enhance self-signed certificate (A toy in local computer).

I refered the answer of Matt Caswell. It works fine to generate the dhcert.pem but fail to configure nginx OpenSSL generates DS-RSA key

I match the dhcert.pem with ssl_certificate entry and the dhkey.pem with ssl_certificate_key entry. However, with 'nginx -t' checker, it says

SSL: error:140BF0F7:SSL routines:ssl_set_cert:unknown certificate type

I've already set the dhparam in the nginx configuration file as well. I don't know what causes the problem.

Also, I accept almost all the cipher:

ssl_prefer_server_ciphers on;

ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK';

1 Answer 1

1

OpenSSL removed support for DH certificates in libssl starting with OpenSSL 1.1.0. You can still create the certificates, but you can't use them in a TLS connection. In order to do so you would have to use an earlier version of OpenSSL (none of which are currently supported by the project). You would need OpenSSL 1.0.2 or earlier.

3
  • Much thanks. That's should be the reason. My VM is ubuntu20.04 which has a version of OpenSSL of 1.1.1.
    – Jiawei Cao
    Jun 24, 2021 at 13:32
  • What's more, in my experiment with v1.1.1, it seems the ECDH can work with nginx configuration. I'm a beginner of it and so... just find it interesting. I think ECDH should have a similar functionality with DH
    – Jiawei Cao
    Jun 24, 2021 at 13:35
  • 1
    A certificate can have an EC public key in it. Such a public key can be used for ECDH (a key exchange algorithm) or ECDSA (a signature algorithm). Current versions of OpenSSL fully support ECDSA based ciphersuites. They do not support static ECDH based ciphersuites. You can install an EC based certificate in OpenSSL 1.1.1 and it will work - but it won't be doing static ECDH. It will end up doing ephemeral ECDH with ECDSA signatures. Jun 24, 2021 at 14:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.