Comments (11)
This is not good. Do you have a way to generate such a certificate or have a sample certificate your can mail me? I imagine only the public portion on the certificate is provided to MeshCentral? - Thanks.
from meshcentral.
@Ylianst I can confirm that an error message appears when you replace the default webserver certificate with an ECDSA certificate. This is the error message in question from mesherrors.txt:
-------- 10/26/2018, 6:08:12 PM ---- 0.2.2-m --------
/meshcentral/node_modules/node-forge/js/x509.js:1274
throw new Error('Cannot read public key. OID is not RSA.');
^
Error: Cannot read public key. OID is not RSA.
at Object.pki.certificateFromAsn1 (/meshcentral/node_modules/node-forge/js/x509.js:1274:11)
at Object.pki.certificateFromPem (/meshcentral/node_modules/node-forge/js/x509.js:716:14)
at Object.obj.GetMeshServerCertificate (/meshcentral/node_modules/meshcentral/certoperations.js:230:42)
at CreateMeshCentralServer.obj.StartEx2 (/meshcentral/node_modules/meshcentral/meshcentral.js:385:35)
at Server.<anonymous> (/meshcentral/node_modules/meshcentral/redirserver.js:108:13)
at Object.onceWrapper (events.js:273:13)
at Server.emit (events.js:182:13)
at emitListeningNT (net.js:1320:10)
at process._tickCallback (internal/process/next_tick.js:63:19)
Here is the public portion of an ECDSA certificate that you can use for testing purposes:
-----BEGIN CERTIFICATE-----
MIIBtjCCAV0CFGuQrjcG9YbJi+rU5i3OMORbcmVGMAoGCCqGSM49BAMCMF4xCzAJ
BgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRIwEAYDVQQHDAlTYW4gRGll
Z28xEDAOBgNVBAoMB0V4YW1wbGUxFDASBgNVBAMMC2V4YW1wbGUuY29tMB4XDTE4
MTAyNjE4MjcyN1oXDTE5MTAyNjE4MjcyN1owXjELMAkGA1UEBhMCVVMxEzARBgNV
BAgMCkNhbGlmb3JuaWExEjAQBgNVBAcMCVNhbiBEaWVnbzEQMA4GA1UECgwHRXhh
bXBsZTEUMBIGA1UEAwwLZXhhbXBsZS5jb20wWTATBgcqhkjOPQIBBggqhkjOPQMB
BwNCAAQzm9Cr/DMpsVBkjAIo+/E+bPYm/QXvsqXr8FlEjgu053hsSIG88eEAZDM6
J1I3HTuq0Frn+IqJfwpyezYA6LtzMAoGCCqGSM49BAMCA0cAMEQCIF2BAITu5kyo
oOsux/Uebq+pSLtt4esib26t2KnozFl+AiBgkGDBVgbeQrAR7mVGmd/KhnWa0ODv
Z/ucirO6TkfDog==
-----END CERTIFICATE-----
from meshcentral.
I think I've discovered the cause of this issue. MeshCentral is using the node version of forge for its native TLS implementation in Javascript. According to this, this and this issue on their GitHub project page, forge doesn't support ECDSA certificates yet. Unless there is a viable alternative to forge, there's probably nothing @Ylianst can do to solve this issue other than to wait for them to implement support for it.
Edit: I think crypto-browserify might be a suitable alternative to forge that supports ECDSA.
from meshcentral.
I may still be able to fix this because I don't need to do any certificate operations on this TLS cert, I just need to make sure the server and agents both see the same cert by having the same hash. So, if I work on this a bit I could hash the ECDSA cert on both sides correctly and not need ForgeJS at all.
Thanks for the ECDSA cert, I can give it a try.
from meshcentral.
@Ylianst Awesome, I'm glad to hear that. Good luck with implementing this feature!
from meshcentral.
@Ylianst I noticed that non-RSA cert hashes are being calculated after a recent commit, but it doesn't seem to be fully supported yet. The hashes that MeshCentral and MeshAgent calculate are different from each other. Is it supposed to be working right now?
from meshcentral.
I got the server ready, but the agent is not. So ECDSA will not work yet. Hope to start testing with a ECDSA cert this week.
from meshcentral.
@Ylianst You are on a roll lately. I love your passion for this project!
from meshcentral.
Just published MeshCentral v0.2.4-a with ECDSA support for certificates in the reverse-proxy. Only the MacOS agent does not support it in this version (next time MacOS is compiled on our side, the support for ECDSA will be there).
To be clear, MeshCentral will only generate and handle RSA certificates on it's own, however, if a reverse-proxy like NGNIX is in front of MeshCentral and it has a ECDSA certificates, MeshCentral and the MeshAgents will handle it correctly.
Testing and feedback appreciated.
from meshcentral.
@Ylianst I tested it and can confirm that MeshCentral works with ECDSA certificates now. I think you can close this issue.
from meshcentral.
I use lego to generate the TLS cert, the default --key-type
is ec256
. When I link the cert file to webserver-cert-private.key
& webserver-cert-public.crt
, forge not support ECDSA.
But I think that's not a big deal, just incase someone has the same problem.
https://go-acme.github.io/lego/usage/cli/options/
digitalbazaar/forge#925
from meshcentral.
Related Issues (20)
- Language Selector not showing up with "showPasswordLogin" "false" HOT 10
- Blank page after upgrade from 1.1.24 to 1.1.25 HOT 10
- language selection on login page doesnt copy through with saml authentication HOT 1
- Browsing from mobile browser , on Linux clients , terminal connection does not respect domains config.json linuxshell:login HOT 4
- update the meshcentral server HOT 6
- AMT activated in ACM. But CIRA: Disconnected HOT 48
- Banco Itaรบ HOT 4
- Chat doesn't work HOT 16
- User Consent Pop up in end machine is hanging HOT 2
- Can`t change user accaunt image. HOT 6
- Meshcentral RDP does not work if AllowEncryptionOracle is set to 0
- Mouse still working if use Remote Input Lock HOT 7
- Request for Security Improvment: The Content Security Policy (CSP) is not very effective. HOT 2
- [BUG] WebRelay HTTP Connection Crashing Server - "Header name must be a valid HTTP token" HOT 16
- after upgrade latest version 1.1.27 files upload freeze HOT 1
- request for mac arm agent HOT 23
- file upload fails when using webrtc HOT 5
- New permission for plugins HOT 3
- New encoding options on Agents HOT 1
- A bouncing account from AD HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. ๐๐๐
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google โค๏ธ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from meshcentral.