I'm trying to use "rustls" to talk to a site with an old self-signed certificate. I have the appropriate root certificate and can get it to parse OK. The problem is that the root certificate is ancient, from 2005, with a 1024 bit RSA key. That key length has been deprecated.
OpenSSL will accept this, but only if I turn the "auth_level" down to 1.
openssl s_client -verifyCAfile LindenLab.crt -connect simhost-0cf44003add587ba0.aditi.secondlife.io:12043 -verify_return_error -auth_level 1
This will fail with an auth_level > 1.
But, even when I feed the root cert into rustls, like this:
fn new_tlsconfig(local_certs: &[&str]) -> Result<rustls::ClientConfig, Error> {
let mut config = rustls::ClientConfig::new(); // empty TLS config
config
.root_store
.add_server_trust_anchors(&webpki_roots::TLS_SERVER_ROOTS); // add all Mozilla root certs
for certstring in local_certs {
// add additional local certs
let mut buf = std::io::Cursor::new(certstring.as_bytes().to_vec()); // string to readable
let (good, bad) = match config.root_store.add_pem_file(&mut buf) {
Ok((good, bad)) => (good, bad),
Err(_) => return Err(anyhow!("Built-in TLS certificate load error.")),
};
log::info!("Added {} special TLS certificates", good);
if good == 0 || bad > 0 {
return Err(anyhow!(
"Built-in TLS certificate load error. {} loaded, {} failed.",
good,
bad
));
}
}
Ok(config)
}
This says it loaded 1 good and 0 bad certs, so it parsed the cert OK. That does not, per the documentation, mean it's cryptographically valid.
I get
Connection Failed: invalid certificate: UnknownIssuer'
Is there some way to get "rustls" to accept this? It's not in the list of "non-features" they don't support by choice. But there's no visible way to set "auth level" or some equivalent thereof, that I can find.
The published self-signed root cert is at https://bitbucket.org/lindenlab/llca/raw/master/LindenLab.crt.
Note that the domain simhost-0cf44003add587ba0.aditi.secondlife.io will disappear after a while; those names are generated dynamically. So testing this way may not work tomorrow.
(Why? I'm writing a new client for Second Life, and talking to some rather old server code.)