1
$\begingroup$

I have an https implementation, using mbedtls. I have installed two certificate - one is a plain RSA 2048 bit certificate, and another is an ECC 256 bit certificate.

I can connect using all browsers - and a test of the implementation with ssllabs works. But chrome will send an alert 47 Illegal parameter message and disconnect.

Why?


So in the SNI callback I install both certificates. And the ECC one is install first, giving it priority.

Here is a log of the handshake:

New connection accepted
initial hs state: HELLO_REQUEST as server
hs state: CLIENT_HELLO, return:  (0)
Ssl recv(5/5):
   0x16, 0x3,  0x1,  0x0,  0xcd, 0x38, 0x3a,

(src/ssl_srv.c:1131): 0x7f5ab00092b8: client hello v3, message type: 22
(src/ssl_srv.c:1140): 0x7f5ab00092b8: client hello v3, message len.: 205
(src/ssl_srv.c:1143): 0x7f5ab00092b8: client hello v3, protocol version: [3:1]
Ssl recv(205/205):
   0x1,  0x0,  0x0,  0xc9, 0x3,  0x3,  0xe8, 0x1e, 0x56, 0x74, 0x85, 0xc9, 0x81, 0xa6, 0x8,  0x27, // 16     ........Vt.....'
   0xb6, 0xe,  0x74, 0x57, 0xc9, 0xfe, 0xf4, 0xc7, 0x70, 0xa8, 0x41, 0x6d, 0x61, 0x3e, 0x89, 0xa1, // 32     ..tW....p.Ama>..
   0x29, 0x7b, 0x8f, 0x3,  0xea, 0x8c, 0x0,  0x0,  0x20, 0xea, 0xea, 0xc0, 0x2b, 0xc0, 0x2f, 0xc0, // 48     ){...... ...+./.
   0x2c, 0xc0, 0x30, 0xcc, 0xa9, 0xcc, 0xa8, 0xcc, 0x14, 0xcc, 0x13, 0xc0, 0x13, 0xc0, 0x14, 0x0,  // 64     ,.0.............
   0x9c, 0x0,  0x9d, 0x0,  0x2f, 0x0,  0x35, 0x0,  0xa,  0x1,  0x0,  0x0,  0x80, 0x5a, 0x5a, 0x0,  // 80     ..../.5......ZZ.
   0x0,  0xff, 0x1,  0x0,  0x1,  0x0,  0x0,  0x0,  0x0,  0x17, 0x0,  0x15, 0x0,  0x0,  0x12, 0x74, // 96     ...............t
   0x65, 0x73, 0x74, 0x2e, 0x64, 0x65, 0x6d, 0x61, 0x6e, 0x67, 0x6c, 0x65, 0x72, 0x2e, 0x63, 0x6f, // 112    est.demangler.co
   0x6d, 0x0,  0x17, 0x0,  0x0,  0x0,  0x23, 0x0,  0x0,  0x0,  0xd,  0x0,  0x14, 0x0,  0x12, 0x4,  // 128    m.....#.........
   0x3,  0x8,  0x4,  0x4,  0x1,  0x5,  0x3,  0x8,  0x5,  0x5,  0x1,  0x8,  0x6,  0x6,  0x1,  0x2,  // 144    ................
   0x1,  0x0,  0x5,  0x0,  0x5,  0x1,  0x0,  0x0,  0x0,  0x0,  0x0,  0x12, 0x0,  0x0,  0x0,  0x10, // 160    ................
   0x0,  0xe,  0x0,  0xc,  0x2,  0x68, 0x32, 0x8,  0x68, 0x74, 0x74, 0x70, 0x2f, 0x31, 0x2e, 0x31, // 176    .....h2.http/1.1
   0x75, 0x50, 0x0,  0x0,  0x0,  0xb,  0x0,  0x2,  0x1,  0x0,  0x0,  0xa,  0x0,  0xa,  0x0,  0x8,  // 192    uP..............
   0x1a, 0x1a, 0x0,  0x1d, 0x0,  0x17, 0x0,  0x18, 0x7a, 0x7a, 0x0,  0x1,  0x0,  0x0,  0x0,

(src/ssl_srv.c:1242): 0x7f5ab00092b8: client hello v3, handshake type: 1
(src/ssl_srv.c:1251): 0x7f5ab00092b8: client hello v3, handshake len.: 201
(src/ssl_srv.c:1340): 0x7f5ab00092b8: dumping 'client hello, version' (2 bytes)
(src/ssl_srv.c:1340): 0x7f5ab00092b8: 0000:  03 03                                            ..
(src/ssl_srv.c:1373): 0x7f5ab00092b8: dumping 'client hello, random bytes' (32 bytes)
(src/ssl_srv.c:1373): 0x7f5ab00092b8: 0000:  e8 1e 56 74 85 c9 81 a6 08 27 b6 0e 74 57 c9 fe  ..Vt.....'..tW..
(src/ssl_srv.c:1373): 0x7f5ab00092b8: 0010:  f4 c7 70 a8 41 6d 61 3e 89 a1 29 7b 8f 03 ea 8c  ..p.Ama>..){....
(src/ssl_srv.c:1389): 0x7f5ab00092b8: dumping 'client hello, session id' (0 bytes)
(src/ssl_srv.c:1469): 0x7f5ab00092b8: dumping 'client hello, ciphersuitelist' (32 bytes)
(src/ssl_srv.c:1469): 0x7f5ab00092b8: 0000:  ea ea c0 2b c0 2f c0 2c c0 30 cc a9 cc a8 cc 14  ...+./.,.0......
(src/ssl_srv.c:1469): 0x7f5ab00092b8: 0010:  cc 13 c0 13 c0 14 00 9c 00 9d 00 2f 00 35 00 0a  .........../.5..
(src/ssl_srv.c:1487): 0x7f5ab00092b8: dumping 'client hello, compression' (1 bytes)
(src/ssl_srv.c:1487): 0x7f5ab00092b8: 0000:  00                                               .
(src/ssl_srv.c:1538): 0x7f5ab00092b8: dumping 'client hello extensions' (128 bytes)
(src/ssl_srv.c:1538): 0x7f5ab00092b8: 0000:  5a 5a 00 00 ff 01 00 01 00 00 00 00 17 00 15 00  ZZ..............
(src/ssl_srv.c:1538): 0x7f5ab00092b8: 0010:  00 12 74 65 73 74 2e 64 65 6d 61 6e 67 6c 65 72  ..test.demangler
(src/ssl_srv.c:1538): 0x7f5ab00092b8: 0020:  2e 63 6f 6d 00 17 00 00 00 23 00 00 00 0d 00 14  .com.....#......
(src/ssl_srv.c:1538): 0x7f5ab00092b8: 0030:  00 12 04 03 08 04 04 01 05 03 08 05 05 01 08 06  ................
(src/ssl_srv.c:1538): 0x7f5ab00092b8: 0040:  06 01 02 01 00 05 00 05 01 00 00 00 00 00 12 00  ................
(src/ssl_srv.c:1538): 0x7f5ab00092b8: 0050:  00 00 10 00 0e 00 0c 02 68 32 08 68 74 74 70 2f  ........h2.http/
(src/ssl_srv.c:1538): 0x7f5ab00092b8: 0060:  31 2e 31 75 50 00 00 00 0b 00 02 01 00 00 0a 00  1.1uP...........
(src/ssl_srv.c:1538): 0x7f5ab00092b8: 0070:  0a 00 08 1a 1a 00 1d 00 17 00 18 7a 7a 00 01 00  ...........zz...
(src/ssl_srv.c:1686): 0x7f5ab00092b8: unknown extension found: 23130 (ignoring)
(src/ssl_srv.c:1567): 0x7f5ab00092b8: found renegotiation extension
(src/ssl_srv.c:1556): 0x7f5ab00092b8: found ServerName extension
(src/ssl_srv.c:98): 0x7f5ab00092b8: parse ServerName extension
(src/ssl_srv.c:1656): 0x7f5ab00092b8: found extended master secret extension
(src/ssl_srv.c:1666): 0x7f5ab00092b8: found session ticket extension
(src/ssl_srv.c:457): 0x7f5ab00092b8: ticket length: 0
(src/ssl_srv.c:1580): 0x7f5ab00092b8: found signature_algorithms extension
(src/ssl_srv.c:228): 0x7f5ab00092b8: client hello v3, signature_algorithm ext: 6
(src/ssl_srv.c:1686): 0x7f5ab00092b8: unknown extension found: 5 (ignoring)
(src/ssl_srv.c:1686): 0x7f5ab00092b8: unknown extension found: 18 (ignoring)
(src/ssl_srv.c:1676): 0x7f5ab00092b8: found alpn extension
(src/ssl_srv.c:1686): 0x7f5ab00092b8: unknown extension found: 30032 (ignoring)
(src/ssl_srv.c:1604): 0x7f5ab00092b8: found supported point formats extension
(src/ssl_srv.c:1596): 0x7f5ab00092b8: found supported elliptic curves extension
(src/ssl_srv.c:1686): 0x7f5ab00092b8: unknown extension found: 31354 (ignoring)
(src/ssl_srv.c:720): 0x7f5ab00092b8: trying ciphersuite: TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
(src/ssl_srv.c:623): 0x7f5ab00092b8: ciphersuite requires certificate
(src/ssl_srv.c:634): 0x7f5ab00092b8: candidate certificate chain, certificate #1:
(src/ssl_srv.c:634): 0x7f5ab00092b8: cert. version     : 3
(src/ssl_srv.c:634): 0x7f5ab00092b8: serial number     : 7F:B3:CA:37:4D:BF:67:DB:A1:38:16:25
(src/ssl_srv.c:634): 0x7f5ab00092b8: issuer name       : C=BE, O=GlobalSign nv-sa, CN=AlphaSSL CA - SHA256 - G2
(src/ssl_srv.c:634): 0x7f5ab00092b8: subject name      : OU=Domain Control Validated, CN=*.demangler.com
(src/ssl_srv.c:634): 0x7f5ab00092b8: issued  on        : 2017-04-09 01:55:21
(src/ssl_srv.c:634): 0x7f5ab00092b8: expires on        : 2020-04-09 01:55:21
(src/ssl_srv.c:634): 0x7f5ab00092b8: signed using      : RSA with SHA-256
(src/ssl_srv.c:634): 0x7f5ab00092b8: EC key size       : 256 bits
(src/ssl_srv.c:634): 0x7f5ab00092b8: basic constraints : CA=false
(src/ssl_srv.c:634): 0x7f5ab00092b8: subject alt name  : *.demangler.com, demangler.com
(src/ssl_srv.c:634): 0x7f5ab00092b8: key usage         : Digital Signature, Key Agreement
(src/ssl_srv.c:634): 0x7f5ab00092b8: ext key usage     : TLS Web Server Authentication, TLS Web Client Authentication
(src/ssl_srv.c:634): 0x7f5ab00092b8: value of 'crt->eckey.Q(X)' (256 bits) is:
(src/ssl_srv.c:634): 0x7f5ab00092b8:  f5 2a ec 42 41 d2 43 07 f2 03 7c 16 f3 4a c4 da
(src/ssl_srv.c:634): 0x7f5ab00092b8:  0f 33 68 6b ee 20 46 49 08 64 c4 c5 b8 8e df 89
(src/ssl_srv.c:634): 0x7f5ab00092b8: value of 'crt->eckey.Q(Y)' (254 bits) is:
(src/ssl_srv.c:634): 0x7f5ab00092b8:  22 93 ed a6 fe 55 e0 da 16 16 11 16 e7 ac a7 a2
(src/ssl_srv.c:634): 0x7f5ab00092b8:  e6 cc 16 dc c6 6a 90 a2 4a 6c 05 ab 25 8a c8 cd
(src/ssl_srv.c:634): 0x7f5ab00092b8: candidate certificate chain, certificate #2:
(src/ssl_srv.c:634): 0x7f5ab00092b8: cert. version     : 3
(src/ssl_srv.c:634): 0x7f5ab00092b8: serial number     : 04:00:00:00:00:01:44:4E:F0:36:31
(src/ssl_srv.c:634): 0x7f5ab00092b8: issuer name       : C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
(src/ssl_srv.c:634): 0x7f5ab00092b8: subject name      : C=BE, O=GlobalSign nv-sa, CN=AlphaSSL CA - SHA256 - G2
(src/ssl_srv.c:634): 0x7f5ab00092b8: issued  on        : 2014-02-20 10:00:00
(src/ssl_srv.c:634): 0x7f5ab00092b8: expires on        : 2024-02-20 10:00:00
(src/ssl_srv.c:634): 0x7f5ab00092b8: signed using      : RSA with SHA-256
(src/ssl_srv.c:634): 0x7f5ab00092b8: RSA key size      : 2048 bits
(src/ssl_srv.c:634): 0x7f5ab00092b8: basic constraints : CA=true, max_pathlen=0
(src/ssl_srv.c:634): 0x7f5ab00092b8: key usage         : Key Cert Sign, CRL Sign
(src/ssl_srv.c:634): 0x7f5ab00092b8: value of 'crt->rsa.N' (2048 bits) is:
(src/ssl_srv.c:634): 0x7f5ab00092b8:  da 01 ec e4 ec 73 60 fb 7e 8f 6a b7 c6 17 e3 92
(src/ssl_srv.c:634): 0x7f5ab00092b8:  64 32 d4 ac 00 d9 a2 0f b9 ed ee 6b 8a 86 ca 92
(src/ssl_srv.c:634): 0x7f5ab00092b8:  67 d9 74 d7 5d 47 02 3c 8f 40 d6 9e 6d 14 cd c3
(src/ssl_srv.c:634): 0x7f5ab00092b8:  da 29 39 a7 0f 05 0a 68 a2 66 1a 1e c4 b2 8b 76
(src/ssl_srv.c:634): 0x7f5ab00092b8:  58 e5 ab 5d 1d 8f 40 b3 39 8b ef 1e 83 7d 22 d0
(src/ssl_srv.c:634): 0x7f5ab00092b8:  e3 a9 00 2e ec 53 cf 62 19 85 44 28 4c c0 27 cb
(src/ssl_srv.c:634): 0x7f5ab00092b8:  7b 0e ec 10 64 00 10 a4 05 cc a0 72 be 41 6c 31
(src/ssl_srv.c:634): 0x7f5ab00092b8:  5b 48 e4 b1 ec b9 23 eb 55 4d d0 7d 62 4a a5 b4
(src/ssl_srv.c:634): 0x7f5ab00092b8:  a5 a4 59 85 c5 25 91 a6 fe a6 09 9f 06 10 6d 8f
(src/ssl_srv.c:634): 0x7f5ab00092b8:  81 0c 64 40 5e 73 00 9a e0 2e 65 98 54 10 00 70
(src/ssl_srv.c:634): 0x7f5ab00092b8:  98 c8 e1 ed 34 5f d8 9c c7 0d c0 d6 23 59 45 fc
(src/ssl_srv.c:634): 0x7f5ab00092b8:  fe 55 7a 86 ee 94 60 22 f1 ae d1 e6 55 46 f6 99
(src/ssl_srv.c:634): 0x7f5ab00092b8:  c5 1b 08 74 5f ac b0 64 84 8f 89 38 1c a1 a7 90
(src/ssl_srv.c:634): 0x7f5ab00092b8:  21 4f 02 6e bd e0 61 67 d4 f8 42 87 0f 0a f7 c9
(src/ssl_srv.c:634): 0x7f5ab00092b8:  04 6d 2a a9 2f ef 42 a5 df dd a3 53 db 98 1e 81
(src/ssl_srv.c:634): 0x7f5ab00092b8:  f9 9a 72 7b 5a de 4f 3e 7f a2 58 a0 e2 17 ad 67
(src/ssl_srv.c:634): 0x7f5ab00092b8: value of 'crt->rsa.E' (17 bits) is:
(src/ssl_srv.c:634): 0x7f5ab00092b8:  01 00 01
(src/ssl_srv.c:696): 0x7f5ab00092b8: selected certificate chain, certificate #1:
(src/ssl_srv.c:696): 0x7f5ab00092b8: cert. version     : 3
(src/ssl_srv.c:696): 0x7f5ab00092b8: serial number     : 7F:B3:CA:37:4D:BF:67:DB:A1:38:16:25
(src/ssl_srv.c:696): 0x7f5ab00092b8: issuer name       : C=BE, O=GlobalSign nv-sa, CN=AlphaSSL CA - SHA256 - G2
(src/ssl_srv.c:696): 0x7f5ab00092b8: subject name      : OU=Domain Control Validated, CN=*.demangler.com
(src/ssl_srv.c:696): 0x7f5ab00092b8: issued  on        : 2017-04-09 01:55:21
(src/ssl_srv.c:696): 0x7f5ab00092b8: expires on        : 2020-04-09 01:55:21
(src/ssl_srv.c:696): 0x7f5ab00092b8: signed using      : RSA with SHA-256
(src/ssl_srv.c:696): 0x7f5ab00092b8: EC key size       : 256 bits
(src/ssl_srv.c:696): 0x7f5ab00092b8: basic constraints : CA=false
(src/ssl_srv.c:696): 0x7f5ab00092b8: subject alt name  : *.demangler.com, demangler.com
(src/ssl_srv.c:696): 0x7f5ab00092b8: key usage         : Digital Signature, Key Agreement
(src/ssl_srv.c:696): 0x7f5ab00092b8: ext key usage     : TLS Web Server Authentication, TLS Web Client Authentication
(src/ssl_srv.c:696): 0x7f5ab00092b8: value of 'crt->eckey.Q(X)' (256 bits) is:
(src/ssl_srv.c:696): 0x7f5ab00092b8:  f5 2a ec 42 41 d2 43 07 f2 03 7c 16 f3 4a c4 da
(src/ssl_srv.c:696): 0x7f5ab00092b8:  0f 33 68 6b ee 20 46 49 08 64 c4 c5 b8 8e df 89
(src/ssl_srv.c:696): 0x7f5ab00092b8: value of 'crt->eckey.Q(Y)' (254 bits) is:
(src/ssl_srv.c:696): 0x7f5ab00092b8:  22 93 ed a6 fe 55 e0 da 16 16 11 16 e7 ac a7 a2
(src/ssl_srv.c:696): 0x7f5ab00092b8:  e6 cc 16 dc c6 6a 90 a2 4a 6c 05 ab 25 8a c8 cd
(src/ssl_srv.c:696): 0x7f5ab00092b8: selected certificate chain, certificate #2:
(src/ssl_srv.c:696): 0x7f5ab00092b8: cert. version     : 3
(src/ssl_srv.c:696): 0x7f5ab00092b8: serial number     : 04:00:00:00:00:01:44:4E:F0:36:31
(src/ssl_srv.c:696): 0x7f5ab00092b8: issuer name       : C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
(src/ssl_srv.c:696): 0x7f5ab00092b8: subject name      : C=BE, O=GlobalSign nv-sa, CN=AlphaSSL CA - SHA256 - G2
(src/ssl_srv.c:696): 0x7f5ab00092b8: issued  on        : 2014-02-20 10:00:00
(src/ssl_srv.c:696): 0x7f5ab00092b8: expires on        : 2024-02-20 10:00:00
(src/ssl_srv.c:696): 0x7f5ab00092b8: signed using      : RSA with SHA-256
(src/ssl_srv.c:696): 0x7f5ab00092b8: RSA key size      : 2048 bits
(src/ssl_srv.c:696): 0x7f5ab00092b8: basic constraints : CA=true, max_pathlen=0
(src/ssl_srv.c:696): 0x7f5ab00092b8: key usage         : Key Cert Sign, CRL Sign
(src/ssl_srv.c:696): 0x7f5ab00092b8: value of 'crt->rsa.N' (2048 bits) is:
(src/ssl_srv.c:696): 0x7f5ab00092b8:  da 01 ec e4 ec 73 60 fb 7e 8f 6a b7 c6 17 e3 92
(src/ssl_srv.c:696): 0x7f5ab00092b8:  64 32 d4 ac 00 d9 a2 0f b9 ed ee 6b 8a 86 ca 92
(src/ssl_srv.c:696): 0x7f5ab00092b8:  67 d9 74 d7 5d 47 02 3c 8f 40 d6 9e 6d 14 cd c3
(src/ssl_srv.c:696): 0x7f5ab00092b8:  da 29 39 a7 0f 05 0a 68 a2 66 1a 1e c4 b2 8b 76
(src/ssl_srv.c:696): 0x7f5ab00092b8:  58 e5 ab 5d 1d 8f 40 b3 39 8b ef 1e 83 7d 22 d0
(src/ssl_srv.c:696): 0x7f5ab00092b8:  e3 a9 00 2e ec 53 cf 62 19 85 44 28 4c c0 27 cb
(src/ssl_srv.c:696): 0x7f5ab00092b8:  7b 0e ec 10 64 00 10 a4 05 cc a0 72 be 41 6c 31
(src/ssl_srv.c:696): 0x7f5ab00092b8:  5b 48 e4 b1 ec b9 23 eb 55 4d d0 7d 62 4a a5 b4
(src/ssl_srv.c:696): 0x7f5ab00092b8:  a5 a4 59 85 c5 25 91 a6 fe a6 09 9f 06 10 6d 8f
(src/ssl_srv.c:696): 0x7f5ab00092b8:  81 0c 64 40 5e 73 00 9a e0 2e 65 98 54 10 00 70
(src/ssl_srv.c:696): 0x7f5ab00092b8:  98 c8 e1 ed 34 5f d8 9c c7 0d c0 d6 23 59 45 fc
(src/ssl_srv.c:696): 0x7f5ab00092b8:  fe 55 7a 86 ee 94 60 22 f1 ae d1 e6 55 46 f6 99
(src/ssl_srv.c:696): 0x7f5ab00092b8:  c5 1b 08 74 5f ac b0 64 84 8f 89 38 1c a1 a7 90
(src/ssl_srv.c:696): 0x7f5ab00092b8:  21 4f 02 6e bd e0 61 67 d4 f8 42 87 0f 0a f7 c9
(src/ssl_srv.c:696): 0x7f5ab00092b8:  04 6d 2a a9 2f ef 42 a5 df dd a3 53 db 98 1e 81
(src/ssl_srv.c:696): 0x7f5ab00092b8:  f9 9a 72 7b 5a de 4f 3e 7f a2 58 a0 e2 17 ad 67
(src/ssl_srv.c:696): 0x7f5ab00092b8: value of 'crt->rsa.E' (17 bits) is:
(src/ssl_srv.c:696): 0x7f5ab00092b8:  01 00 01
(src/ssl_srv.c:1838): 0x7f5ab00092b8: selected ciphersuite: TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
hs state: SERVER_HELLO, return:  (0)
(src/ssl_srv.c:2259): 0x7f5ab00092b8: server hello, chosen version: [3:3]
(src/ssl_srv.c:2268): 0x7f5ab00092b8: server hello, current time: 1492488077
(src/ssl_srv.c:2283): 0x7f5ab00092b8: dumping 'server hello, random bytes' (32 bytes)
(src/ssl_srv.c:2283): 0x7f5ab00092b8: 0000:  58 f5 8f 8d 5c b5 52 47 a9 f0 a6 e9 69 a7 ca 71  X...\.RG....i..q
(src/ssl_srv.c:2283): 0x7f5ab00092b8: 0010:  1d 9f e8 c2 e1 e2 fb b1 1e e6 4a 9d 81 6e 94 0e  ..........J..n..
(src/ssl_srv.c:2356): 0x7f5ab00092b8: server hello, session id len.: 0
(src/ssl_srv.c:2357): 0x7f5ab00092b8: dumping 'server hello, session id' (0 bytes)
(src/ssl_srv.c:2359): 0x7f5ab00092b8: no session has been resumed
(src/ssl_srv.c:2366): 0x7f5ab00092b8: server hello, chosen ciphersuite: TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
(src/ssl_srv.c:2368): 0x7f5ab00092b8: server hello, compress alg.: 0x00
(src/ssl_srv.c:1987): 0x7f5ab00092b8: server hello, secure renegotiation extension
(src/ssl_srv.c:1938): 0x7f5ab00092b8: server hello, adding extended master secret extension
(src/ssl_srv.c:1963): 0x7f5ab00092b8: server hello, adding session ticket extension
(src/ssl_srv.c:2058): 0x7f5ab00092b8: server hello, supported_point_formats extension
(src/ssl_srv.c:2423): 0x7f5ab00092b8: server hello, total extension length: 19
(src/ssl_tls.c:2838): 0x7f5ab00092b8: output record: msgtype = 22, version = [3:3], msglen = 63
(src/ssl_tls.c:2435): 0x7f5ab00092b8: message length: 68, out_left: 68
Ssl send(68/68):
   0x16, 0x3,  0x3,  0x0,  0x3f, 0x2,  0x0,  0x0,  0x3b, 0x3,  0x3,  0x58, 0xf5, 0x8f, 0x8d, 0x5c, // 16     ....?...;..X...\
   0xb5, 0x52, 0x47, 0xa9, 0xf0, 0xa6, 0xe9, 0x69, 0xa7, 0xca, 0x71, 0x1d, 0x9f, 0xe8, 0xc2, 0xe1, // 32     .RG....i..q.....
   0xe2, 0xfb, 0xb1, 0x1e, 0xe6, 0x4a, 0x9d, 0x81, 0x6e, 0x94, 0xe,  0x0,  0xc0, 0x2b, 0x0,  0x0,  // 48     .....J..n....+..
   0x13, 0xff, 0x1,  0x0,  0x1,  0x0,  0x0,  0x17, 0x0,  0x0,  0x0,  0x23, 0x0,  0x0,  0x0,  0xb,  // 64     ...........#....
   0x0,  0x2,  0x1,  0x0,  0x15, 0xf4,

hs state: SERVER_CERTIFICATE, return:  (0)

Negotiated cipher (helo TLS v1.0): 0xc02b TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256ecc-key, forward-secrecy, strong
(src/ssl_srv.c:3806): 0x7f5ab00092b8: server state: 3
(src/ssl_tls.c:4159): 0x7f5ab00092b8: own certificate #1:
(src/ssl_tls.c:4159): 0x7f5ab00092b8: cert. version     : 3
(src/ssl_tls.c:4159): 0x7f5ab00092b8: serial number     : 7F:B3:CA:37:4D:BF:67:DB:A1:38:16:25
(src/ssl_tls.c:4159): 0x7f5ab00092b8: issuer name       : C=BE, O=GlobalSign nv-sa, CN=AlphaSSL CA - SHA256 - G2
(src/ssl_tls.c:4159): 0x7f5ab00092b8: subject name      : OU=Domain Control Validated, CN=*.demangler.com
(src/ssl_tls.c:4159): 0x7f5ab00092b8: issued  on        : 2017-04-09 01:55:21
(src/ssl_tls.c:4159): 0x7f5ab00092b8: expires on        : 2020-04-09 01:55:21
(src/ssl_tls.c:4159): 0x7f5ab00092b8: signed using      : RSA with SHA-256
(src/ssl_tls.c:4159): 0x7f5ab00092b8: EC key size       : 256 bits
(src/ssl_tls.c:4159): 0x7f5ab00092b8: basic constraints : CA=false
(src/ssl_tls.c:4159): 0x7f5ab00092b8: subject alt name  : *.demangler.com, demangler.com
(src/ssl_tls.c:4159): 0x7f5ab00092b8: key usage         : Digital Signature, Key Agreement
(src/ssl_tls.c:4159): 0x7f5ab00092b8: ext key usage     : TLS Web Server Authentication, TLS Web Client Authentication
(src/ssl_tls.c:4159): 0x7f5ab00092b8: value of 'crt->eckey.Q(X)' (256 bits) is:
(src/ssl_tls.c:4159): 0x7f5ab00092b8:  f5 2a ec 42 41 d2 43 07 f2 03 7c 16 f3 4a c4 da
(src/ssl_tls.c:4159): 0x7f5ab00092b8:  0f 33 68 6b ee 20 46 49 08 64 c4 c5 b8 8e df 89
(src/ssl_tls.c:4159): 0x7f5ab00092b8: value of 'crt->eckey.Q(Y)' (254 bits) is:
(src/ssl_tls.c:4159): 0x7f5ab00092b8:  22 93 ed a6 fe 55 e0 da 16 16 11 16 e7 ac a7 a2
(src/ssl_tls.c:4159): 0x7f5ab00092b8:  e6 cc 16 dc c6 6a 90 a2 4a 6c 05 ab 25 8a c8 cd
(src/ssl_tls.c:4159): 0x7f5ab00092b8: own certificate #2:
(src/ssl_tls.c:4159): 0x7f5ab00092b8: cert. version     : 3
(src/ssl_tls.c:4159): 0x7f5ab00092b8: serial number     : 04:00:00:00:00:01:44:4E:F0:36:31
(src/ssl_tls.c:4159): 0x7f5ab00092b8: issuer name       : C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
(src/ssl_tls.c:4159): 0x7f5ab00092b8: subject name      : C=BE, O=GlobalSign nv-sa, CN=AlphaSSL CA - SHA256 - G2
(src/ssl_tls.c:4159): 0x7f5ab00092b8: issued  on        : 2014-02-20 10:00:00
(src/ssl_tls.c:4159): 0x7f5ab00092b8: expires on        : 2024-02-20 10:00:00
(src/ssl_tls.c:4159): 0x7f5ab00092b8: signed using      : RSA with SHA-256
(src/ssl_tls.c:4159): 0x7f5ab00092b8: RSA key size      : 2048 bits
(src/ssl_tls.c:4159): 0x7f5ab00092b8: basic constraints : CA=true, max_pathlen=0
(src/ssl_tls.c:4159): 0x7f5ab00092b8: key usage         : Key Cert Sign, CRL Sign
(src/ssl_tls.c:4159): 0x7f5ab00092b8: value of 'crt->rsa.N' (2048 bits) is:
(src/ssl_tls.c:4159): 0x7f5ab00092b8:  da 01 ec e4 ec 73 60 fb 7e 8f 6a b7 c6 17 e3 92
(src/ssl_tls.c:4159): 0x7f5ab00092b8:  64 32 d4 ac 00 d9 a2 0f b9 ed ee 6b 8a 86 ca 92
(src/ssl_tls.c:4159): 0x7f5ab00092b8:  67 d9 74 d7 5d 47 02 3c 8f 40 d6 9e 6d 14 cd c3
(src/ssl_tls.c:4159): 0x7f5ab00092b8:  da 29 39 a7 0f 05 0a 68 a2 66 1a 1e c4 b2 8b 76
(src/ssl_tls.c:4159): 0x7f5ab00092b8:  58 e5 ab 5d 1d 8f 40 b3 39 8b ef 1e 83 7d 22 d0
(src/ssl_tls.c:4159): 0x7f5ab00092b8:  e3 a9 00 2e ec 53 cf 62 19 85 44 28 4c c0 27 cb
(src/ssl_tls.c:4159): 0x7f5ab00092b8:  7b 0e ec 10 64 00 10 a4 05 cc a0 72 be 41 6c 31
(src/ssl_tls.c:4159): 0x7f5ab00092b8:  5b 48 e4 b1 ec b9 23 eb 55 4d d0 7d 62 4a a5 b4
(src/ssl_tls.c:4159): 0x7f5ab00092b8:  a5 a4 59 85 c5 25 91 a6 fe a6 09 9f 06 10 6d 8f
(src/ssl_tls.c:4159): 0x7f5ab00092b8:  81 0c 64 40 5e 73 00 9a e0 2e 65 98 54 10 00 70
(src/ssl_tls.c:4159): 0x7f5ab00092b8:  98 c8 e1 ed 34 5f d8 9c c7 0d c0 d6 23 59 45 fc
(src/ssl_tls.c:4159): 0x7f5ab00092b8:  fe 55 7a 86 ee 94 60 22 f1 ae d1 e6 55 46 f6 99
(src/ssl_tls.c:4159): 0x7f5ab00092b8:  c5 1b 08 74 5f ac b0 64 84 8f 89 38 1c a1 a7 90
(src/ssl_tls.c:4159): 0x7f5ab00092b8:  21 4f 02 6e bd e0 61 67 d4 f8 42 87 0f 0a f7 c9
(src/ssl_tls.c:4159): 0x7f5ab00092b8:  04 6d 2a a9 2f ef 42 a5 df dd a3 53 db 98 1e 81
(src/ssl_tls.c:4159): 0x7f5ab00092b8:  f9 9a 72 7b 5a de 4f 3e 7f a2 58 a0 e2 17 ad 67
(src/ssl_tls.c:4159): 0x7f5ab00092b8: value of 'crt->rsa.E' (17 bits) is:
(src/ssl_tls.c:4159): 0x7f5ab00092b8:  01 00 01
(src/ssl_tls.c:2701): 0x7f5ab00092b8: => write record
(src/ssl_tls.c:2838): 0x7f5ab00092b8: output record: msgtype = 22, version = [3:3], msglen = 2794
(src/ssl_tls.c:2416): 0x7f5ab00092b8: => flush output
(src/ssl_tls.c:2435): 0x7f5ab00092b8: message length: 2799, out_left: 2799
Ssl send(2799/2799):
   0x16, 0x3,  0x3,  0xa,  0xea, 0xb,  0x0,  0xa,  0xe6, 0x0,  0xa,  0xe3, 0x0,  0x6,  0x8c, 0x30, // 16     ...............0
   0x2d, 0x73, 0x61, 0x31, 0x22, 0x30, 0x20, 0x6,  0x3,  0x55, 0x4,  0x3,  0x13, 0x19, 0x41, 0x6c, // 112    -sa1"0 ..U....Al

...snip...

   0xe6, 0x3,  0x14, 0x4e, 0xee, 0xfd, 0x6d, 0x94, 0x64, 0x9e, 0x5e, 0xce, 0x79, 0xd4, 0xb2, 0xa6, // 2784   ...N..m.d.^.y...
   0xcf, 0x40, 0xb1, 0x44, 0xa8, 0x3e, 0x87, 0x19, 0x5e, 0xe9, 0xf8, 0x21, 0x16, 0x59, 0x53, 0x0,  // 2800   .@.D.>..^..!.YS.
   0x0,

hs state: SERVER_KEY_EXCHANGE, return:  (0)
(src/ssl_srv.c:3806): 0x7f5ab00092b8: server state: 4
(src/ssl_srv.c:2827): 0x7f5ab00092b8: ECDHE curve: secp256r1
(src/ssl_srv.c:2850): 0x7f5ab00092b8: value of 'ECDH: Q (X)' (251 bits) is:
(src/ssl_srv.c:2850): 0x7f5ab00092b8:  04 1f fe 93 11 81 bf de e2 65 e1 9a d3 57 5b 01
(src/ssl_srv.c:2850): 0x7f5ab00092b8:  54 f7 9e b7 23 20 46 58 fd 20 3e 70 f9 fe 7f 12
(src/ssl_srv.c:2850): 0x7f5ab00092b8: value of 'ECDH: Q (Y)' (256 bits) is:
(src/ssl_srv.c:2850): 0x7f5ab00092b8:  9d 5f ae 9f 72 2f 5b d2 9b bf 7d 97 49 6b e1 bf
(src/ssl_srv.c:2850): 0x7f5ab00092b8:  41 c6 ec 3f f6 65 2e 04 21 9f d8 82 9b 64 7e e0
(src/ssl_srv.c:2979): 0x7f5ab00092b8: dumping 'parameters hash' (64 bytes)
(src/ssl_srv.c:2979): 0x7f5ab00092b8: 0000:  7a ef 2d a1 20 3d 19 e1 96 57 e0 8c 2a a7 89 4d  z.-. =...W..*..M
(src/ssl_srv.c:2979): 0x7f5ab00092b8: 0010:  fc bf 49 8f 7c 76 3b 0b 0a ba cb 9e 91 7b 02 e0  ..I.|v;......{..
(src/ssl_srv.c:2979): 0x7f5ab00092b8: 0020:  d8 68 a9 26 17 e5 f6 03 be 21 f4 29 83 8b 6a c5  .h.&.....!.)..j.
(src/ssl_srv.c:2979): 0x7f5ab00092b8: 0030:  04 d6 ab 38 88 44 c0 ff bb f2 6e 71 92 53 ad e9  ...8.D....nq.S..
(src/ssl_srv.c:3012): 0x7f5ab00092b8: dumping 'my signature' (71 bytes)
(src/ssl_srv.c:3012): 0x7f5ab00092b8: 0000:  30 45 02 20 4c 4b 69 82 84 1b be a9 66 88 67 78  0E. LKi.....f.gx
(src/ssl_srv.c:3012): 0x7f5ab00092b8: 0010:  b3 50 03 b5 95 8f 7b 5e e2 05 60 d4 0f b2 37 7d  .P....{^..`...7}
(src/ssl_srv.c:3012): 0x7f5ab00092b8: 0020:  dd 0d 21 66 02 21 00 b1 19 a3 de 7f 9f 7f 56 6f  ..!f.!........Vo
(src/ssl_srv.c:3012): 0x7f5ab00092b8: 0030:  d8 fe c7 22 13 c8 88 ee 0c 2a 33 ca d8 0e ee f1  ...".....*3.....
(src/ssl_srv.c:3012): 0x7f5ab00092b8: 0040:  88 2e 08 d1 f8 2b 83                             .....+.
Ssl send(153/153):
   0x16, 0x3,  0x3,  0x0,  0x94, 0xc,  0x0,  0x0,  0x90, 0x3,  0x0,  0x17, 0x41, 0x4,  0x4,  0x1f, // 16     ............A...
   0xfe, 0x93, 0x11, 0x81, 0xbf, 0xde, 0xe2, 0x65, 0xe1, 0x9a, 0xd3, 0x57, 0x5b, 0x1,  0x54, 0xf7, // 32     .......e...W[.T.
   0x9e, 0xb7, 0x23, 0x20, 0x46, 0x58, 0xfd, 0x20, 0x3e, 0x70, 0xf9, 0xfe, 0x7f, 0x12, 0x9d, 0x5f, // 48     ..# FX. >p....._
   0xae, 0x9f, 0x72, 0x2f, 0x5b, 0xd2, 0x9b, 0xbf, 0x7d, 0x97, 0x49, 0x6b, 0xe1, 0xbf, 0x41, 0xc6, // 64     ..r/[...}.Ik..A.
   0xec, 0x3f, 0xf6, 0x65, 0x2e, 0x4,  0x21, 0x9f, 0xd8, 0x82, 0x9b, 0x64, 0x7e, 0xe0, 0x6,  0x3,  // 80     .?.e..!....d~...
   0x0,  0x47, 0x30, 0x45, 0x2,  0x20, 0x4c, 0x4b, 0x69, 0x82, 0x84, 0x1b, 0xbe, 0xa9, 0x66, 0x88, // 96     .G0E. LKi.....f.
   0x67, 0x78, 0xb3, 0x50, 0x3,  0xb5, 0x95, 0x8f, 0x7b, 0x5e, 0xe2, 0x5,  0x60, 0xd4, 0xf,  0xb2, // 112    gx.P....{^..`...
   0x37, 0x7d, 0xdd, 0xd,  0x21, 0x66, 0x2,  0x21, 0x0,  0xb1, 0x19, 0xa3, 0xde, 0x7f, 0x9f, 0x7f, // 128    7}..!f.!........
   0x56, 0x6f, 0xd8, 0xfe, 0xc7, 0x22, 0x13, 0xc8, 0x88, 0xee, 0xc,  0x2a, 0x33, 0xca, 0xd8, 0xe,  // 144    Vo...".....*3...
   0xee, 0xf1, 0x88, 0x2e, 0x8,  0xd1, 0xf8, 0x2b, 0x83, 0xf5, 0x9d,

hs state: CERTIFICATE_REQUEST, return:  (0)
hs state: SERVER_HELLO_DONE, return:  (0)
Ssl send(9/9):
   0x16, 0x3,  0x3,  0x0,  0x4,  0xe,  0x0,  0x0,  0x0,  0x0,  0x0,

hs state: CLIENT_CERTIFICATE, return:  (0)
hs state: CLIENT_KEY_EXCHANGE, return:  (0)

Ssl recv(5/5):
   0x15, 0x3,  0x3,  0x0,  0x2,  0x7f, 0x0,

Ssl recv(2/2):
   0x2,  0x2f, 0x3,  0x0,

(src/ssl_tls.c:3961): 0x7f5ab00092b8: got an alert message, type: [2:47]
(src/ssl_tls.c:3969): 0x7f5ab00092b8: is a fatal alert message (msg 47)
hs state: CLIENT_KEY_EXCHANGE, return: SSL - A fatal alert message was received from our peer (-30592)
handshake failure: SSL - A fatal alert message was received from our peer (-30592)
ssl-conn: 0.0.0.0:443         SSL handshake aborted by peer with SSL Alert code: ILLEGAL_PARAMETER (47), TLS v1.2  

More specifically, here is the cert I send:

(src/ssl_srv.c:634): 0x7f5ab00092b8: cert. version     : 3
(src/ssl_srv.c:634): 0x7f5ab00092b8: serial number     : 7F:B3:CA:37:4D:BF:67:DB:A1:38:16:25
(src/ssl_srv.c:634): 0x7f5ab00092b8: issuer name       : C=BE, O=GlobalSign nv-sa, CN=AlphaSSL CA - SHA256 - G2
(src/ssl_srv.c:634): 0x7f5ab00092b8: subject name      : OU=Domain Control Validated, CN=*.demangler.com
(src/ssl_srv.c:634): 0x7f5ab00092b8: issued  on        : 2017-04-09 01:55:21
(src/ssl_srv.c:634): 0x7f5ab00092b8: expires on        : 2020-04-09 01:55:21
(src/ssl_srv.c:634): 0x7f5ab00092b8: signed using      : RSA with SHA-256
(src/ssl_srv.c:634): 0x7f5ab00092b8: EC key size       : 256 bits
(src/ssl_srv.c:634): 0x7f5ab00092b8: basic constraints : CA=false
(src/ssl_srv.c:634): 0x7f5ab00092b8: subject alt name  : *.demangler.com, demangler.com
(src/ssl_srv.c:634): 0x7f5ab00092b8: key usage         : Digital Signature, Key Agreement
(src/ssl_srv.c:634): 0x7f5ab00092b8: ext key usage     : TLS Web Server Authentication, TLS Web Client Authentication

Then here is the cipher that gets negotiated:

(src/ssl_srv.c:2366): 0x7f5ab00092b8: server hello, chosen ciphersuite: TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256  

Then later ephemeral keys are negotiated using curve secp256r1

(src/ssl_srv.c:3806): 0x7f5ab00092b8: server state: 4
(src/ssl_srv.c:2827): 0x7f5ab00092b8: ECDHE curve: secp256r1  

But then tragedy strikes, as soon as I send the SERVER_HELLO_DONE, I get back alert 47 illegal parameter.

If I understand this right, some parameter that was sent during server hello sequence, Chrome doesn't like. It could be maybe I'm sending something that Chrome does not consider secure, or something is not compatible - e.g. cert not compatible with negotiated cipher.

But what?


The server exhibiting this problem is live at test.demangler.com

$\endgroup$

closed as off-topic by e-sushi Apr 19 '17 at 21:52

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Programming questions are off-topic even if you are writing or debugging cryptographic code. Unless your question is specifically about how the cryptographic algorithm or protocol works, you should look into asking on Stack Overflow instead." – e-sushi
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    $\begingroup$ This is a question related not to coding - there is no code in the question . Its indeed a question about how the protocol works: what could be going wrong in this ssl handshake. The answer is in fact a mismatch in a supported hash functions. $\endgroup$ – Rafael Baptista Apr 19 '17 at 22:04
7
$\begingroup$

I've made a packet capture of the connection between Chrome and your server for better analysis. Looking at the Server Key Exchange send from your server one can see that it uses SHA512 with ECDSA as the signature hash algorithm:

Server Key Exchange

But, looking at the signature_algorithm extension in the ClientHello send by Chrome one can see, that the hash algorithm your server sends is not announced as supported by the client. That looks like a bug in the server implementation because only algorithms supported by the client should be used:

signature_algorithm in ClientHello

$\endgroup$
  • $\begingroup$ Looks like a bug in mbedtls. I'll try to fix it and see if it solves the problem. And if so I'll come back and give you the checkmark. Thanks. $\endgroup$ – Rafael Baptista Apr 19 '17 at 19:17
  • 5
    $\begingroup$ @RafaelBaptista Looks like github.com/ARMmbed/mbedtls/issues/823 — mbedtls checks only the hash part and not the signature part, so it sees that SHA-512 is ok and misses that it's ok with RSA but not with ECDSA. $\endgroup$ – Gilles Apr 19 '17 at 19:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.