Unable to access http server using SSL

[Amit Mhetre]

Hello guys,

I tried to start vertx http server with SSL as below,

HttpServer server = vertx.createHttpServer();

server.setSSL(true).setKeyStorePath(PATH_TO_KEYSTORE).setKeyStorePassword("changeit");

server.listen(3500, HOSTNAME);

Server was starting with no errors, but I am not able to access any of the URL's( with https ) from it.

It seems that it fails to take self-signed certificate from the keystore, thats why it won't give me any suggestion in the browser as well.

Can someone please tell me where I am going wrong. Or any changes needed in current logic.

Thanks in advance.

[Tim Fox]

Hi Amit,

Do you have a reproducer?

Self signed certs should work fine, we use them in the test suite.

https://github.com/eclipse/vert.x/blob/master/src/test/java/io/vertx/test/core/HttpTest.java#L2683

--
You received this message because you are subscribed to the Google Groups "vert.x" group.
To unsubscribe from this group and stop receiving emails from it, send an email to vertx+un...@googlegroups.com.
Visit this group at http://groups.google.com/group/vertx.
To view this discussion on the web, visit https://groups.google.com/d/msgid/vertx/c6368a55-f941-4f0e-bc1a-184d0570cabb%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Amit Mhetre]

Below is the steps that I followed to create and add self-signed certificate to java key store.

openssl genrsa -out myKey.pem 2048

openssl req -new -key myKey.pem -out csr.pem

openssl req -x509 -days 365 -key myKey.pem -in csr.pem -out myCertificate.pem

keytool -import -keystore myKeyStore -file myCertificate.pem -alias myCA

My code is,

HttpServer server = vertx.createHttpServer();

RouteMatcher routeMatcher = new RouteMatcher();

routeMatcher.get("/get", new Handler<HttpServerRequest>() {

  @Override

  public void handle(HttpServerRequest e) {

    e.response().end("Hello world !!");

  }

});

server.requestHandler(routeMatcher);

server.setSSL(true).setKeyStorePath("/home/amit/myKeyStore").setKeyStorePassword("changeit");

server.listen(3500, "localhost");

If I fire “https://localhost:3500/get” it gives me response as

                                         This webpage is not available

I am configuring this for first time, so not able to find this issue yet.

I am using vertx 2.1.6, java 1.8.0_45 and ubuntu 14.04 LTS.

[Tim Fox]

I recommend starting at a working example (e.g. the one in the vertx-examples repo).

Convince yourself that works, then slowly change it, until it doesn't work. That should give you a pointer as to where the problem lies.

To view this discussion on the web, visit https://groups.google.com/d/msgid/vertx/33e0410e-e96b-46b0-a0c3-08f6f958ce3a%40googlegroups.com.

[Amit Mhetre]

Thanks Tim,

I refer to the example provided in vertx-examples, it was very helpful.

What I found is that, my certificate has Signature algorithm name as SHA1withDSA and your certificate has SHA256withRSA.

So when I change the Signature algorithm name to SHA256withRSA it works perfectly.

Once again thanks for your quick and kind support. 

Regards,

Amit Mhetre

Software Engineer, Infiverve Technologies Pvt Ltd.

[Adam Medeiros]

This is interesting. I too can't get https to work as advertised. Are there examples (or documentation) somewhere that specifies how the pem files for self-signed certificates should be generated to make this work? I generated mine as SHA265 with RSA - however, I used rsa:4096 vs. the widely used rsa:2048. Would love to see the manual on what exactly is needed for generating the self-signed certificate if they won't all work.

I'll try and generate one with rsa:2048 tomorrow to see if that works, but is that true? Only very specifically created pem files work?

[Julien Viet]

Hi,

we do support PKCS8 format and non encrypted PKCS1 format in PEM files:

https://vertx.io/docs/apidocs/io/vertx/core/net/PemKeyCertOptions.html

HTH

Julien

On 7 Aug 2018, at 08:41, Adam Medeiros <adam...@gmail.com> wrote:

This is interesting. I too can't get https to work as advertised. Are there examples (or documentation) somewhere that specifies how the pem files for self-signed certificates should be generated to make this work? I generated mine as SHA265 with RSA - however, I used rsa:4096 vs. the widely used rsa:2048. Would love to see the manual on what exactly is needed for generating the self-signed certificate if they won't all work.

I'll try and generate one with rsa:2048 tomorrow to see if that works, but is that true? Only very specifically created pem files work?

--
You received this message because you are subscribed to the Google Groups "vert.x" group.
To unsubscribe from this group and stop receiving emails from it, send an email to vertx+un...@googlegroups.com.

Visit this group at https://groups.google.com/group/vertx.
To view this discussion on the web, visit https://groups.google.com/d/msgid/vertx/395f32d3-b38e-4911-a1ea-8602794ead3a%40googlegroups.com.

[Adam Medeiros]

Thanks Julien!

Unfortunately, I'm not able to generate a PKCS8 key and crt that works. The server hangs when I call listen(8443). I added a Proc handler to capture the failure or success of calling listen, but the proc isn't called. Something is hanging and it's not clear what it is.

What is the formula for creating the PKCS8 key and crt files that you have used and that works for you?

Thanks again,

Adam

[Julien Viet]

https://github.com/eclipse/vert.x/blob/master/src/test/resources/tls/ssl.txt#L40

Julien

--
You received this message because you are subscribed to the Google Groups "vert.x" group.
To unsubscribe from this group and stop receiving emails from it, send an email to vertx+un...@googlegroups.com.
Visit this group at https://groups.google.com/group/vertx.

To view this discussion on the web, visit https://groups.google.com/d/msgid/vertx/c21e616f-128d-4757-8f79-99464bffe27a%40googlegroups.com.

[Adam Medeiros]

Thanks again Julien.

Just so I'm clear in my understanding - when I'm trying to do this in ruby within a jar file (java -jar my_jar.jar), and I have the following code:

options = {

      'ssl' => true,

      'useAlpn' => true,

      'pemKeyCertOptions' => {

          'keyPath' =>  'ssl/server-key.pem',

          'certPath' => 'ssl/localhost.crt'

      }

  }

server = $vertx.create_http_server(options)
router = VertxWeb::Router.router($vertx)

done_handler = Proc.new {|c|

  c.response.put_header('content-type', 'application/json').end({msg: 'Received'}.to_json)

}

router.route("/ping").handler(&done_handler)

server.request_handler(&router.method(:accept)).listen(8443)

 

 Where should the pem and crt go exactly when running this as a jar? I currently have them inside resources within an ssl folder (src/main/resources/ssl). I've tried moving that folder around to various places to try to understand where the application is looking when I pass in the path. I've tried adding a forward slash to the paths as well. Since the app hangs when listen is called, and it doesn't throw an error when it can't find the pem and crt, it's causing a lot of guess work to get this to run. I've seen examples where the pem and crt file locations vary. What am I doing wrong? This app listens on port 8080 without ssl options passed in.

  I'm quite sure that most Vertx apps are running in ssl, and of course you have passing tests which proves that this should work for everyone. I think the issue I'm personally having is getting Ruby/Vertx/Jar/SSL pieces all in harmony. Is there a working example somewhere that is as simple as the above code, is written in ruby and is run as a Jar? Or, do you see the obvious mistake I'm making?

  It would be nice if the app didn't hang without raising a helpful error when it can't find the certs/pems. At least then, I'd know what the app is expecting and where it's expecting it.

Anyway, thank you for your prompt replies. SSL is crucial and I appreciate the hand holding as I am getting started.

[Adam Medeiros]

Should I file an issue about .listen(...) not raising an error if the certs can't be found or aren't in the correct location?

[Adam Medeiros]

To reproduce this, all one needs to do is set ssl: true in the options with no cert paths or anything else. 

options = {

  ssl: true

}

server = $vertx.create_http_server(options)

.....

.....

server.listen(<port num>) will hang and never raise an exception. This isn't expected behavior. The server should require everything it needs to start https or raise - right?

[Julien Viet]

yes it should, can you file an issue with a reproducing test ?

--
You received this message because you are subscribed to the Google Groups "vert.x" group.
To unsubscribe from this group and stop receiving emails from it, send an email to vertx+un...@googlegroups.com.
Visit this group at https://groups.google.com/group/vertx.

To view this discussion on the web, visit https://groups.google.com/d/msgid/vertx/96c9a288-ff1d-4718-a64b-43dfadd0c510%40googlegroups.com.

[Adam Medeiros]

Yeah - I'll do that.

I also found this example to not work:

https://github.com/vert-x/vertx-examples/blob/master/src/raw/ruby/https/https_server.rb#L19

(NoMethodError) undefined method `ssl=' for #<Vertx::HttpServer:0x556e0956>

org.jruby.embed.EvalFailedException: (NoMethodError) undefined method `ssl=' for #<Vertx::HttpServer:0x556e0956>

at org.jruby.embed.internal.EmbedEvalUnitImpl.run(EmbedEvalUnitImpl.java:131)

at org.jruby.embed.ScriptingContainer.runUnit(ScriptingContainer.java:1307)

at org.jruby.embed.ScriptingContainer.runScriptlet(ScriptingContainer.java:1323)

at io.vertx.lang.ruby.ContainerHolder.create(ContainerHolder.java:133)

at io.vertx.lang.ruby.JRubyVerticle.start(JRubyVerticle.java:43)

at io.vertx.core.impl.DeploymentManager.lambda$doDeploy$8(DeploymentManager.java:483)

at io.vertx.core.impl.ContextImpl.lambda$wrapTask$2(ContextImpl.java:339)

at io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:163)

at io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:404)

at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:463)

at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:886)

at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)

at java.lang.Thread.run(Thread.java:748)

Caused by: org.jruby.exceptions.RaiseException: (NoMethodError) undefined method `ssl=' for #<Vertx::HttpServer:0x556e0956>

I think the example is outdated. So, we'll need to go through and clean up all of these examples as well (unless of course, I'm completely missing something) so that future Vertx discoverers have an easier time of things. If anyone out there is paying attention to this thread in the hopes of also figuring out how to run this in https mode, I still haven't figured it out. I'm still trying every sort of file location combination that I can to get my app to not hang on listen() - so far, nothing works.

[Julien Viet]

that's the old vert examples of 2.x

look at the repository description : https://github.com/vert-x/vertx-examples

so the examples are here : https://github.com/vert-x3/vertx-examples/tree/master/core-examples/src/main/ruby/io/vertx/example/core/http/https

I will "archive" these repositories. (when I updated the description, archive waas not yet available).

Julien

-- 
You received this message because you are subscribed to the Google Groups "vert.x" group.
To unsubscribe from this group and stop receiving emails from it, send an email to vertx+un...@googlegroups.com.
Visit this group at https://groups.google.com/group/vertx.

To view this discussion on the web, visit https://groups.google.com/d/msgid/vertx/7870a674-b918-4426-9301-fda87ff75b8f%40googlegroups.com.

[Adam Medeiros]

Here's what I finally had to do. I created an ssl directory in my resources folder that contained a pkcs1 pem and cert file created by following the steps posted here:

https://github.com/eclipse/vert.x/blob/master/src/test/resources/tls/ssl.txt#L40

I then needed to fetch those files from the resources folder, read the files to string and then base64 those files for the options hash:

  class_loader = java.lang.Thread.currentThread().getContextClassLoader()

  key_file = class_loader.get_resource 'ssl/server-key-pkcs1.pem'

  crt_file = class_loader.get_resource 'ssl/server-cert.pem'

  key = File.read key_file.get_path

  crt = File.read crt_file.get_path

  options = {

      'ssl' => true,

      'pemKeyCertOptions' => {

          'keyValue'  => Base64.strict_encode64(key),

          'certValue' => Base64.strict_encode64(crt)

      }

  }

  server = $vertx.create_http_server(options)

  router = VertxWeb::Router.router($vertx)

  ...

  ...

  ...

  server.listen(8443)

  This doesn't hang. It currently doesn't work to pass options in with paths to the files if you are running this as a jar application. The documentation, while well-intentioned, isn't up to date on how to configure SSL for a production environment running as a jar. Nor does it raise exceptions properly so that one can diagnose a faulty SSL options hash.

  I hope this helps someone. I'm finally unstuck.

[Adam Medeiros]

Thank you, Julien, for pointing me down some paths.

Adam

Julien

To unsubscribe from this group and stop receiving emails from it, send an email to vertx+unsubscribe@googlegroups.com.

Visit this group at https://groups.google.com/group/vertx.
To view this discussion on the web, visit https://groups.google.com/d/msgid/vertx/7870a674-b918-4426-9301-fda87ff75b8f%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "vert.x" group.

To unsubscribe from this group and stop receiving emails from it, send an email to vertx+unsubscribe@googlegroups.com.

Visit this group at https://groups.google.com/group/vertx.

To view this discussion on the web, visit https://groups.google.com/d/msgid/vertx/5A17DBC3-0B7A-40CE-8744-9A486973C127%40julienviet.com.

For more options, visit https://groups.google.com/d/optout.

--

A.R. Medeiros