willc0de4food

willc0de4food

Sending / receiving TCP requests with SSL certificate

Hello,

I’m attempting to communicate with the Verisign EPP server over a TCP / SSL connection. This connection requires an SSL certificate, but I’m having trouble with the SSL certificate. I am inexperienced in working with anything like this, in the past all I’ve done is use Req to send various requests of different verbs. So has anyone written a library to make this easier? Or can anyone assist in the correct configuration of including an SSL certificate, sending a request and listening for a response? Here’s what I have so far, just shooting in the dark:

  def ssl_client() do
    host = Application.get_env(:appname, :epp_host) |> String.to_charlist()
    port = Application.get_env(:appname, :epp_port)
    cert = File.cwd!() <> "/ssl/cert.chain.pem"

    {:ok, connect_socket} =
      :ssl.connect(host, port, [verify: :verify_none, cacertfile: cert, active: true], :infinity)

    connect_socket
  end

  defp listen_ssl(socket) do
    case :ssl.recv(socket, 0) do
      {:ok, line} ->
        IO.puts(~s(Client got: "#{String.trim(line)}"))
        :ok = :ssl.close(socket)

      {:error, :closed} ->
        IO.puts("Server closed socket.")

      {:error, :enotconn} ->
        IO.puts("Server is not connected.")

      {:error, reason} ->
        IO.puts("Server errored with code: #{reason}")
    end
  end

  def send_ssl_request(line) do
    socket = ssl_client()
    :ssl.send(socket, line)
    listen_ssl(socket)
  end

The response that I get when I attempt to call send_ssl_request() is:
TLS :client: In state :connection received SERVER ALERT: Fatal - Bad Certificate

Thanks!

Marked As Solved

willc0de4food

willc0de4food

I finally found the right combination of options to get it working. What a pain! Somehow this ended up working:

  def ssl_start() do
    host = Application.get_env(:appname, :epp_host) |> String.to_charlist()
    port = Application.get_env(:appname, :epp_port)
    certs = File.cwd!() <> "/ssl/certs.pem"
    key = File.cwd!() <> "/ssl/key.pem"
    :public_key.cacerts_load(certs)

    opts = [
      cacerts: :public_key.cacerts_get(),
      verify: :verify_none,
      certfile: certs,
      keyfile: key
    ]

    :ssl.start()

    case :ssl.connect(host, port, opts, 5000) do
      {:ok, socket} ->
        socket

      {:error, err} ->
        dbg(err)
        nil
    end
  end

I received a file with 1 key & 3 certs. I tried separating each cert into it’s own file, but the working combination was to have the 3 certs in 1 file, and the key in another.

Also Liked

D4no0

D4no0

On what are you running this server? It might be possible that you are missing the client certificates on your deployed system, the symptom usually is that it works on dev envs but fails on deployed server.

To check that fast, you can try adding castore to your project and use the provided certs by castore with: CAStore.file_path()

muelthe

muelthe

A couple of things that have caught me out in the past, one being when using :public_key_cacerts_get() I didn’t have the certificate store configured correctly on my host machine.

Second, I’ve found that I also need to include the server_name_indication (SNI) in my ssl opts (some info here on SNI: https://www.cloudflare.com/learning/ssl/what-is-sni/).

Where Next?

Popular in Questions Top

gshaw
What is the idiomatic way of matching for not nil in Elixir? E.g., First way: defp halt_if_not_signed_in(conn, signed_in_account) when...
New
joaquinalcerro
Hi there, I am working with Ecto-Postgresql and I need to call all of the records from a specific table but the table has 40,000 record...
New
ycv005
I have followed this StackOverflow post to install the specific version of Erlang. And When I am running mix ecto.setup then getting fol...
New
fireproofsocks
I’m working on defining a simple Ecto schema for a table (in PostGres), but I don’t see where I can define a column as NOT NULL. Conside...
New
mcarvalho
What is the difference between System.get_env and Application.get_env? For example, what are best practices to use one versus another.
New
hpopp
To simplify some tasks at work, I wrote and published this package yesterday. It’s a simple macro that enables Access behaviour on struct...
New
Mooodi
Given a string, how can I get access to its character by index? Enum.at("my_string", 2) doesn't work. Or rather, not char, but a substr...
New
jc00ke
Expanding on this topic: https://forum.elixirforum.net/t/map-typespec-question/19217 Let’s say I have a map with required and optional k...
New
jay1
Why is it that the mnesia database isn’t the most preferred database for use in Elixir/Phoenix?
New
vrod
I am using the Starship cross-shell prompt – it seems pretty nice, but I get some errors: [WARN] - (starship::utils): Executing command ...
New

Other popular topics Top

jononomo
I am trying to figure out how Mix knows whether the environment is test, dev, or prod -- where is this set? Thanks.
New
pmjoe
I have a relationship of love and hate with Elixir. Lots of things are just absolutely right, but there are some things that are kind of ...
New
joaquinalcerro
Hi there, I am working with Ecto-Postgresql and I need to call all of the records from a specific table but the table has 40,000 record...
New
ycv005
I have followed this StackOverflow post to install the specific version of Erlang. And When I am running mix ecto.setup then getting fol...
New
grych
Hi folks, Few months ago I have announced the proof-of-concept of the library to manipulate the browsers DOM objects directly from Elixi...
639 49522 488
New
romenigld
I am trying to run a deploy with docker and I successfully runned with this command: docker build -t romenigld/blog-prod . but when I t...
New
fireproofsocks
I’m working on defining a simple Ecto schema for a table (in PostGres), but I don’t see where I can define a column as NOT NULL. Conside...
New
danschultzer
None of the current solutions worked well for me, so I went ahead and built a user management system from scratch. This project took far...
548 27727 240
New
stefanluptak
Hello everybody, usually, I use a 29" ultra-wide monitor for VSCode which can easily accomodate explorer (files panel) + file with code ...
New
josevalim
Hi everyone, One of the features added to Elixir early on to help integration with Erlang code was the idea of overridable function defi...
New

We're in Beta

About us Mission Statement