Upgrade 4.6 to 4.7, SSL Problem with MQTT Integration

brocaar · March 27, 2024, 8:57am

To add some context to this, ChirpStack v4.7 migrated from OpenSSL to Rustls. The big advantage is that it is no longer needed to (cross)compile OpenSSL such that ChirpStack can be linked against it.

Unfortunately, Rustls is more restrictive in the certificate formats that it accept than OpenSSL. As far as I understand PKCS#8 is in general the preferred method. For RSA private-keys, there is an easy fix and ChirpStack will automatically do the conversion to PKCS#8:

github.com

chirpstack/chirpstack/blob/master/chirpstack/src/certificate.rs#L102


      
          
              Ok((
                  not_after,
                  ca_cert.serialize_pem()?,
                  app_cert.serialize_pem_with_signer(&ca_cert)?,
                  app_cert.serialize_private_key_pem(),
              ))
          }
          
          fn private_key_to_pkcs8(pem: &str) -> Result<String> {
              if pem.contains("RSA PRIVATE KEY") {
                  let pkey = RsaPrivateKey::from_pkcs1_pem(pem).context("Read RSA PKCS#1")?;
                  let pkcs8_pem = pkey.to_pkcs8_pem(LineEnding::default())?;
                  Ok(pkcs8_pem.as_str().to_owned())
              } else {
                  Ok(pem.to_string())
              }
          }

Unfortunate for EC keys I haven’t found an easy solution yet, see also: sec1: Trait DecodeEcPrivateKey not implemented for EcPrivateKey · Issue #747 · RustCrypto/formats · GitHub

Contributions are welcome