Question about server certificates. about mumbledj HOT 5 CLOSED

Anything related to certificates is handled by the tls go package, specifically LoadX509KeyPair(). LoadX509KeyPair takes a public/private key pair as its input.

If you use --insecure you shouldn't have to provide any cert or key. Is the bot still not able to connect when using --insecure? Do you require users who connect to your server to have certificates?

from mumbledj.

My issue isn't with just getting the bot to connect. If --cert/--key are supposed to be for SSL pinning, then they don't work. You can do pinning by only providing the server's cert or key. Requiring the server's private key for that is aboslutely the wrong thing to do. So, what are the purpose of --cert/--key? What is the intended feature?

From the Go docs, what I am probably looking for would be use the tls Dial, then get the ConnectionState from the Conn, then compare the cert provided to the bot with the PeerCertificates. (Or the public key provided to the bot with the public keys extracted from the PeerCertificates.)

from mumbledj.

Sorry about the late response, been busy with work.

I think it may be worth opening an issue on the gumble repo, as I'm simply following the example set there.

Here's an example in a related project where the same method is used: https://github.com/layeh/piepan/blob/master/cmd/piepan/main.go#L62-L72

If you know of a better/more secure way to do this, please feel free to open a PR. To be quite honest with you I'm not an expert on SSL-related things.

from mumbledj.

It looks like those two parameters are not for pinning but for user auth, since piepan and gumble's sample code don't accept the user's key and cert in p12 format.

For pinning, the general idea would be connect, get the connection state, then from that get the peer certificates and make sure the public key of one of the certs matches a public key for the server that the user provides. I don't think most users would care for this feature, though.

from mumbledj.

Yeah, the key and cert are in pem format.

You can, however, use the --p12 commandline argument to supply a p12 file for authenticating as a registered user.

from mumbledj.