2

I am trying to configure Janus Gateway and I am experiencing with an issue with my self-signed certificate, see log below

Jan 25 09:50:46 localhost platform: [2018/01/25 09:50:46 EST] [EROR] /api/v4/webrtc/token:WebRTC.Token code=500 rid=7mgqedeejpnt3gginnpj5ikape uid=k7m4t6r663frfqaoo5enspfuqh ip=192.168.20.3 We encountered an error while connecting to the server [details: Post https://192.168.20.140:7889/admin: x509: cannot validate certificate for 192.168.20.140 because it doesn't contain any IP SANs]

My hostname is webrtc, IP address is 192.168.20.140 and local DNS is 192.168.20.1

My understanding is I probably didnd't have the SAN information in my certificate so I modified the command that generates the certificate request by following online tutorials. See my configuration file below.

[ req ]
default_bits            = 2048                  # RSA key size
encrypt_key             = yes                   # Protect private key
default_md              = sha256                # MD to use
utf8                    = yes                   # Input is UTF-8
string_mask             = utf8only              # Emit UTF-8 strings
prompt                  = yes                   # Prompt for DN
distinguished_name      = san_dn           # DN template
x509_extensions     = v3_ca
req_extensions          = san_reqext       # Desired extensions
x509_extensions     = usr_cert

[ san_dn ]
countryName             = "1. Country Name (2 letters) (eg, US)       "
countryName_max         = 2
stateOrProvinceName     = "2. State or Province Name   (eg, region)   "
localityName            = "3. Locality Name            (eg, city)     "
organizationName        = "4. Organization Name        (eg, company)  "
organizationalUnitName  = "5. Organizational Unit Name (eg, section)  "
commonName              = "6. Common Name              (eg, full name)"
commonName_max          = 64

[ san_reqext ]
subjectKeyIdentifier    = hash
basicConstraints    = CA:FALSE
keyUsage                = critical,digitalSignature
extendedKeyUsage        = critical,codeSigning, msCodeInd, msCodeCom
nsCertType      = client,server,email,objsign
subjectAltName      = @alt_names

[ usr_cert ]
subjectKeyIdentifier    = hash
basicConstraints    = CA:FALSE
keyUsage                = critical,digitalSignature
extendedKeyUsage        = critical,codeSigning, msCodeInd, msCodeCom
nsCertType      = client,server,email,objsign
authorityKeyIdentifier  = keyid,issuer

[ alt_names ]
DNS.0           = localhost
DNS.1           = webrtc
DNS.2           = 192.168.20.140
DNS.3           = 192.168.20.1

Below is the command I use to generate my certificate request

openssl req -new -key ./webrtc_secret.key -config ./san_request.cfg -out ./webrtc.csr

Below is the command I use to generate the certificate using my self-sign CA and generated certificate request

openssl x509 -req -in ./webrtc.csr -CA ./rootCA.pem -CAkey ./rootCA.key -CAcreateserial \
-out ./webrtc.pem -days 365 -sha256 

Can you spot anything wrong with my certificate request?

Update 1:

Looks like my generated certificate request has the right information.

Requested Extensions:
    X509v3 Subject Key Identifier: 
        F0:CA:B8:FE:FA:CE:29:CE:0E:CB:01:93:B6:97:96:30:8E:B3:16:DB
    X509v3 Basic Constraints: 
        CA:FALSE
    X509v3 Key Usage: critical
        Digital Signature
    X509v3 Extended Key Usage: critical
        Code Signing, Microsoft Individual Code Signing, Microsoft Commercial Code Signing
    Netscape Cert Type: 
        SSL Client, SSL Server, S/MIME, Object Signing
    X509v3 Subject Alternative Name: 
        DNS:localhost, DNS:webrtc, DNS:192.168.20.140, DNS:192.168.20.1

Update 2 So you would think openssl would use all your information from the certificate request when generating the certificate. WRONG! I have to manually specify the extension when generating the self-sign certificate using certificate request. See below example below... This might be the answer. I am going to try it now

openssl x509 -req -in ./webrtc.csr -CA ./rootCA.pem -CAkey ./rootCA.key -CAcreateserial -out ./webrtc.pem -days 365 -sha256 -extfile ./san_ext.cfg -extensions san_reqext

[ req ]
req_extensions          = san_reqext       # Desired extensions

[ san_reqext ]
subjectAltName      = @alt_names

[ alt_names ]
DNS.0           = localhost
DNS.1           = mattermost
IP.0            = 192.168.20.140
IP.1            = 192.168.20.1

Not sure where is the lost of information.

  • Are you sure the service is using the right certificate file? Have you restarted it since you updated the cert? – Andrew Schulman Jan 25 '18 at 15:26
  • 1
    I am pretty sure it's taking my certificate because I would get different error message when I insert another certificate. For example, if I didn't have the chained certificate then I would get an unknown ca error. – beyonddc Jan 25 '18 at 15:29
1

The IP addresses in the Subject Alternate Name section need to be identified as IP, instead of DNS. So change the alt_names section of your OpenSSL configuration file to look like this:

[ alt_names ]
DNS.0           = localhost
DNS.1           = webrtc
IP.0            = 192.168.20.140
IP.1            = 192.168.20.1

Then regenerate the request and certificate.

  • The request does include SAN but the generated certificate still doesn't have the SAN. X509v3 Subject Alternative Name: DNS:localhost, DNS:mattermost, IP Address:192.168.20.140, IP Address:192.168.20.1 I try to print the certificate using the following command and DNS information shows up. openssl x509 -text -noout -in target/webrtc.pem | grep DNS – beyonddc Jan 25 '18 at 15:56
  • Try adding -extensions usr_cert to the openssl x509 command that you use to sign the cert. According to the manual page for x509, extensions from the request aren't included unless you ask for them. – Andrew Schulman Jan 25 '18 at 16:06
0

Please read my whole question and then read my update 2. Update 2 has the answer in detail.

So you would think openssl would use all your information from the certificate request when generating the certificate. WRONG! I have to manually specify the extension when generating the self-sign certificate using certificate request.

Here's an example...

openssl x509 -req -in ./webrtc.csr -CA ./rootCA.pem -CAkey ./rootCA.key -CAcreateserial -out ./webrtc.pem -days 365 -sha256 -extfile ./san_ext.cfg -extensions san_reqext

[ req ]
req_extensions          = san_reqext       # Desired extensions

[ san_reqext ]
subjectAltName      = @alt_names

[ alt_names ]
DNS.0           = localhost
DNS.1           = mattermost
IP.0            = 192.168.20.140
IP.1            = 192.168.20.1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.