Hi! My self-signed certificate is rejected by browsers and curl.

The problem:

On curl I get the error: curl: (52) Empty reply from server from curl.
Firefox warns me that the certificate is self-signed, I click to continue and it never gets a response. Chromium gives similar results.

On the terminal I sometimes get:

[info]  ['TLS', 32, 'server', 58, 32, 73, 110, 32, 115, 116, 97, 11
6, 101, 32, 'abbreviated', 32, 'received CLIENT ALERT: Fatal - Certificate Unkno
wn', 10]  

What does work:

Everything works fine with plain http. When using the cowboy interface directly the results are the same, plain http works, https doesn’t. I was able to successfully setup self-signed certificates with Nginx, they were not the ones generated by mix x509.gen.selfsigned (see below) but they also did not work with plug_cowboy or cowboy.
I think the problem might be that I’m not passing a cacertfile parameter (for a self-signed certificate authority that signs my certificate), but I don’t know how to generate that.

The setup:

All on a single machine, with a fresh mix project created only for this.

I generated a self-signed certificate with: mix x509.gen.selfsigned, it was put in the default location: priv/cert/. It appears that the default hostname it uses is localhostbut I tried passing a specific name too, only to get the same result.

I’m on Debian 10 amd64;

Erlang/OTP 21 [erts-10.2.4] [source] [64-bit] [smp:12:12] [ds:12:12:10] [async-threads:1]

Interactive Elixir (1.7.4) - press Ctrl+C to exit (type h() ENTER for help)

My plug is in lib/https_tests.ex:

defmodule HttpsTests do
  import Plug.Conn

  def init(options) do
    # initialize options
    options
  end

  def call(conn, _opts) do
    conn
    |> put_resp_content_type("text/plain")
    |> send_resp(200, "Hello world")
  end
end

My lib/https_tests/application.ex:

defmodule HttpsTests.Application do
  # See https://hexdocs.pm/elixir/Application.html
  # for more information on OTP Applications
  @moduledoc false

  use Application

  def start(_type, _args) do
    # List all child processes to be supervised
    children = [
      {Plug.Cowboy, scheme: :https, plug: HttpsTests, 
       options: [
	 port: 4001,
	 cipher_suite: :strong,
	 certfile: "priv/cert/selfsigned.pem",
	 keyfile: "priv/cert/selfsigned_key.pem",
	 otp_app: :https_tests
       ]}
    ]

    # See https://hexdocs.pm/elixir/Supervisor.html
    # for other strategies and supported options
    opts = [strategy: :one_for_one, name: HttpsTests.Supervisor]
    Supervisor.start_link(children, opts)
  end
end

Thanks!