Can't Ignore SSL Error ERR_SSL_DH_KEY_TOO_SMALL about undici HOT 16 CLOSED

I'm still having some hard times reproducing, most likely might be doing it wrong; though, an openssl.cnf example for a customized behaviour should follow a similar format:

nodejs_conf = default_conf

[ default_conf ]

ssl_conf = ssl_sect

[ssl_sect]

system_default = system_default_sect

[system_default_sect]
MinProtocol = TLSv2
CipherString = DEFAULT:@SECLEVEL=2

And should be passed down to node using its either flag or the environment variable OPENSSL_CONFIG.
e.g. flag
node --openssl-config /path/to/config script.js

or through env var
OPENSSL_CONF=/path/to/config node script.js

from undici.

Hi @metcoder95 sry for wrong issue report. I tried with your openssl.cnf format and it's working fine. I bet i miss-unerstood the tutorials about how to write this file 😶‍🌫️

from undici.

@metcoder95 i closed this issue a bit too fast. I succeed to reproduce the bug with previous openssl version. Here is how to proceed :

This openssl.cnf file

nodejs_conf = default_conf

[ default_conf ]

ssl_conf = ssl_sect

[ssl_sect]

system_default = system_default_sect

[system_default_sect]
MinProtocol = TLSv1.2
CipherString = DEFAULT:@SECLEVEL=2

Then node --openssl-config ./openssl.cnf and execute

const { Agent, setGlobalDispatcher, fetch } = await import('undici');
setGlobalDispatcher(new Agent({ connect: { rejectUnauthorized: false, } }))

await fetch('https://www.aerocontact.com/entreprise-aeronautique/societe-latecoere-1128/offres-emploi-aeronautique?')

This will throw ERR_SSL_DH_KEY_TOO_SMALL.

PS : If you get UND_ERR_CONNECT_TIMEOUT error, just run the fetch again (this website is really slow)

from undici.

Nice, thanks! I was able to reproduce it; Now, lowering the sec level to 1 did the trick for me; did you try it already?

nodejs_conf = default_conf

[ default_conf ]

ssl_conf = ssl_sect

[ssl_sect]

system_default = system_default_sect

[system_default_sect]
MinProtocol = TLSv1.2
CipherString = DEFAULT:@SECLEVEL=1

Reference

from undici.

ah, ok sorry, now I got you 👍
And no, it doesn't work like that; the rejectUnauthorized is meant for CAs, as it will mandate whether or not reject requests whose certificate has a valid CA (avoiding self-signed or similar)

from undici.

You can do it by passing the cipher property to the Agent under the connect scope, e.g.

setGlobalDispatcher(
  new Agent({
    allowH2: true,
    connect: {
      rejectUnauthorized: false,
      ciphers: 'DEFAULT:@SECLEVEL=2',
    }
  })
)

That should do the work 👍

from undici.

I confirm this is working fine 🤩 Thank you for your time ! :)

The solution working for my case:

const { Agent, setGlobalDispatcher, fetch } = await import('undici');
setGlobalDispatcher(new Agent({ connect: { ciphers: 'DEFAULT:@SECLEVEL=1' } }))

await fetch('https://www.aerocontact.com/entreprise-aeronautique/societe-latecoere-1128/offres-emploi-aeronautique?')

from undici.

Found the documentation ^^. For those landing on this issue, it's located here: https://undici.nodejs.org/#/docs/api/Client?id=parameter-connectoptions with a link to this documentation: https://nodejs.org/api/tls.html#tls_tls_connect_options_callback

from undici.

I've tried to reproduce it without luck. When trying to reproduce it with also another local reproduction still do not have any luck, fetch fails if rejectUnauthorized is set to true and goes through otherwise.

const server = createServer(pem, (req, res) => {
  res.writeHead(200, { 'content-type': 'text/plain' })
  res.end('hello h1!')
})

setGlobalDispatcher(new Agent({ connect: { rejectUnauthorized: false } }))

server.listen(0, () => {
  const { port, address, family } = server.address()
  const host = family === 'IPv6' ? `[${address}]` : address

  fetch(`https://${host}:${port}`).then(
    res => {
      console.log(res.status, res.statusText)
    },
    err => console.log(err)
  ).then(() => server.close())
})

from undici.

Hi @metcoder95 thank you for your quick answer. I made some tests and i did not reproduce on linux with OpenSSL 3.1.x. Maybe the problem come whith OpenSSL 3.2.0 ... I'm searching a bit more to be sure.

from undici.

I made some tests i think (for reasons i don't know) undici ignores openssl configuration.

I edited /etc/ssl/openssl.cnf file on my system

With Following configuration (low sec level) :

[ default_conf ]

ssl_conf = ssl_sect

[ssl_sect]

system_default = system_default_sect

[system_default_sect]
MinProtocol = TLSv1.2
CipherString = DEFAULT:@SECLEVEL=1

I get this this =>

Curl working :
curl 'https://www.aerocontact.com/entreprise-aeronautique/societe-latecoere-1128/offres-emploi-aeronautique?'

node.js fetch throw

With default configuration (normal sec level) or this configuration :

[ default_conf ]

ssl_conf = ssl_sect

[ssl_sect]

system_default = system_default_sect

[system_default_sect]
MinProtocol = TLSv2
CipherString = DEFAULT:@SECLEVEL=2

Curl :
curl 'https://www.aerocontact.com/entreprise-aeronautique/societe-latecoere-1128/offres-emploi-aeronautique?'
Output : > curl: (35) OpenSSL/3.2.0: error:0A00018A:SSL routines::dh key too small

Node.js Fetch fails but it's normal

I hope this helps

from undici.

It seems to me undici with node.js use its own openssl service / configuration file and ignore system configuration and --openssl-config argument

from undici.

I guess it was working on some of my servers since openssl changed it's default security levels recently and my servers were just a bit late.

from undici.

Hi @metcoder95 yes lowering it to 1 do the trick to me too, and that's why i closed the issue a bit quickly first.

Then i remembered my issue was that setGlobalDispatcher(new Agent({ connect: { rejectUnauthorized: false, } })) does not make fetch ignore this error ^^

Should't rejectUnauthorized: false make the request work even with "bad sec level" ?

from undici.

Good to know 😁.
Do you think it would be possible to have a boolean controlling if its possible to disable this security check on one request ? Or does it need to be done at node.js level ?

This would be useful so it's possible to decrease security only for specific requests :)

from undici.

By the way do you think it worth a mention in the official Agent documentation ? I don't find reference of such ciphers parameter ^^

from undici.