I am trying to configure Janus Gateway and I am experiencing with an issue with my self-signed certificate, see log below
Jan 25 09:50:46 localhost platform: [2018/01/25 09:50:46 EST] [EROR] /api/v4/webrtc/token:WebRTC.Token code=500 rid=7mgqedeejpnt3gginnpj5ikape uid=k7m4t6r663frfqaoo5enspfuqh ip=192.168.20.3 We encountered an error while connecting to the server [details: Post https://192.168.20.140:7889/admin: x509: cannot validate certificate for 192.168.20.140 because it doesn't contain any IP SANs]
My hostname is webrtc, IP address is 192.168.20.140 and local DNS is 192.168.20.1
My understanding is I probably didnd't have the SAN information in my certificate so I modified the command that generates the certificate request by following online tutorials. See my configuration file below.
[ req ] default_bits = 2048 # RSA key size encrypt_key = yes # Protect private key default_md = sha256 # MD to use utf8 = yes # Input is UTF-8 string_mask = utf8only # Emit UTF-8 strings prompt = yes # Prompt for DN distinguished_name = san_dn # DN template x509_extensions = v3_ca req_extensions = san_reqext # Desired extensions x509_extensions = usr_cert [ san_dn ] countryName = "1. Country Name (2 letters) (eg, US) " countryName_max = 2 stateOrProvinceName = "2. State or Province Name (eg, region) " localityName = "3. Locality Name (eg, city) " organizationName = "4. Organization Name (eg, company) " organizationalUnitName = "5. Organizational Unit Name (eg, section) " commonName = "6. Common Name (eg, full name)" commonName_max = 64 [ san_reqext ] subjectKeyIdentifier = hash basicConstraints = CA:FALSE keyUsage = critical,digitalSignature extendedKeyUsage = critical,codeSigning, msCodeInd, msCodeCom nsCertType = client,server,email,objsign subjectAltName = @alt_names [ usr_cert ] subjectKeyIdentifier = hash basicConstraints = CA:FALSE keyUsage = critical,digitalSignature extendedKeyUsage = critical,codeSigning, msCodeInd, msCodeCom nsCertType = client,server,email,objsign authorityKeyIdentifier = keyid,issuer [ alt_names ] DNS.0 = localhost DNS.1 = webrtc DNS.2 = 192.168.20.140 DNS.3 = 192.168.20.1
Below is the command I use to generate my certificate request
openssl req -new -key ./webrtc_secret.key -config ./san_request.cfg -out ./webrtc.csr
Below is the command I use to generate the certificate using my self-sign CA and generated certificate request
openssl x509 -req -in ./webrtc.csr -CA ./rootCA.pem -CAkey ./rootCA.key -CAcreateserial \ -out ./webrtc.pem -days 365 -sha256
Can you spot anything wrong with my certificate request?
Looks like my generated certificate request has the right information.
Requested Extensions: X509v3 Subject Key Identifier: F0:CA:B8:FE:FA:CE:29:CE:0E:CB:01:93:B6:97:96:30:8E:B3:16:DB X509v3 Basic Constraints: CA:FALSE X509v3 Key Usage: critical Digital Signature X509v3 Extended Key Usage: critical Code Signing, Microsoft Individual Code Signing, Microsoft Commercial Code Signing Netscape Cert Type: SSL Client, SSL Server, S/MIME, Object Signing X509v3 Subject Alternative Name: DNS:localhost, DNS:webrtc, DNS:192.168.20.140, DNS:192.168.20.1
Update 2 So you would think openssl would use all your information from the certificate request when generating the certificate. WRONG! I have to manually specify the extension when generating the self-sign certificate using certificate request. See below example below... This might be the answer. I am going to try it now
openssl x509 -req -in ./webrtc.csr -CA ./rootCA.pem -CAkey ./rootCA.key -CAcreateserial -out ./webrtc.pem -days 365 -sha256 -extfile ./san_ext.cfg -extensions san_reqext [ req ] req_extensions = san_reqext # Desired extensions [ san_reqext ] subjectAltName = @alt_names [ alt_names ] DNS.0 = localhost DNS.1 = mattermost IP.0 = 192.168.20.140 IP.1 = 192.168.20.1
Not sure where is the lost of information.