Curl does not respect --insecure option? (wolfSSL)

hnyman · January 26, 2021, 9:25pm

Well, the wolfssl docs hint that the first function, called before your extract, on line 137, "wc_InitCert" always initialised it to RSA

github.com

wolfSSL/wolfssl/blob/84ee1509b736cac51bd1b2f13fb7e86505b0735a/doc/dox_comments/header_files/asn_public.h

/*!
    \ingroup ASN

    \brief This function initializes a default cert, with the default options:
    version = 3 (0x2), serial = 0, sigType = SHA_WITH_RSA, issuer = blank,
    daysValid = 500, selfSigned = 1 (true) use subject as issuer,
    subject = blank

    \return none No returns.

    \param cert pointer to an uninitialized cert structure to initialize

    _Example_
    \code
    Cert myCert;
    wc_InitCert(&myCert);
    \endcode

    \sa wc_MakeCert
    \sa wc_MakeCertReq

This file has been truncated. show original

initializes a default cert, with the default options:
version = 3 (0x2), serial = 0, sigType = SHA_WITH_RSA,

I have not tried to follow the upstream source to see if that gets overwritten later, but that might be at least one explanation why your cert showed the first sha1WithRSAEncryption

hnyman · January 26, 2021, 9:31pm

I guess that this requires some input from the wolfssl people. We are too laymen to quickly get into the bottom of why there are mixed algorithm types even though our function calls should already be properly using only ec or rsa.

Hopefully we get some feedback from upstream.

PolynomialDivision · January 26, 2021, 11:07pm

Fixed with:

anon50098793 · January 26, 2021, 11:29pm

random footnote... curl seems to be the only thing pulling wolfssl stuff into my imagebuilder image ( similar to hnyman my builds try to go with openssl everything )...

if anyone in the future is able to make curl not just depend on wolfssl that would be lovely... cheers.

hnyman · January 27, 2021, 5:21am

If you compile with the full toolchain (like I do), you can nicely set curl to depend on openssl.

As explanation, the curl package has not been modified to have variants so that there would be different versions available for imagebuilder. The SSL library selection is just a compile time option, available when compiling from sources.

system · February 6, 2021, 5:21am

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.