2

I am using collider (https://github.com/webrtc/apprtc/tree/master/src/collider -a websockets server in go) and I am trying to add SSL/TLS support. For which I generated self-signed certificates:

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365

Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:CA
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:testwebsite.com
Organizational Unit Name (eg, section) []:Engineering
Common Name (e.g. server FQDN or YOUR name) []:www.testwebsite.com
Email Address []:testwebsite@gmail.com

When I run the collider, I see this error:

2017/06/05 21:25:50 Error Run: crypto/tls: failed to parse private key

When I generate using (based on http://www.kaihag.com/https-and-go/):

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout key.pem -out cert.pem

I get this error:

2017/06/05 22:11:31 http: TLS handshake error from <some-ip>:1082: remote error: unknown certificate

How to fix this?

Note: collider uses golang.org/x/net/websocket

ssk
  • 9,045
  • 26
  • 96
  • 169
  • ***`CN=www.example.com`*** is probably wrong. Hostnames always go in the *SAN*. If its present in the *CN*, then it must be present in the *SAN* too (you have to list it twice in this case). For more rules and reasons, see [How do you sign Certificate Signing Request with your Certification Authority](http://stackoverflow.com/a/21340898/608639) and [How to create a self-signed certificate with openssl?](http://stackoverflow.com/q/10175812/608639) You will also need to place the self-signed certificate in the appropriate trust store. – jww Jun 07 '17 at 01:00
  • @jww thanks for the pointers. I followed step-by-step: https://jamielinux.com/docs/openssl-certificate-authority/sign-server-and-client-certificates.html#create-a-certificate Created a root cert and then an intermedia. I used the intermedia to sign the cert for my website. I still get the unknown certificate error. – ssk Jun 08 '17 at 05:08

1 Answers1

1

I ended up obtaining the certs from: https://certbot.eff.org/#ubuntuxenial-other

certbot certonly --standalone -d example.com -d www.example.com

I had to use fullchain.pem instead of cert.pem for this collider to work:

https://github.com/webrtc/apprtc/issues/442

ssk
  • 9,045
  • 26
  • 96
  • 169