async-tls icon indicating copy to clipboard operation
async-tls copied to clipboard

SSL error while using async_tls

Open localacct opened this issue 4 years ago • 2 comments

Hi

When I tried to use async_tls to establish a TLS connection to a ncat instance (using self signed certificates that I generated), I saw this error from the ncat terminal and the connection just close.

Ncat: Failed SSL connection from 127.0.0.1: error:00000000:lib(0):func(0):reason(0)

I noticed on Wireshark that the program attempts the normal TCP handshake and then followed by FIN-ACK to close the connection. I did not see the TLS protocol being initiated. I followed the code snippet from async_tls' documentation.

async_std::task::block_on(async {
    let connector = TlsConnector::default();
    let tcp_stream = async_std::net::TcpStream::connect("127.0.0.1:4444").await?;
    let encrypted_stream = connector.connect("127.0.0.1:4444", tcp_stream).await?;

    Ok(()) as async_std::io::Result<()>
});

Could this be related to the certificate not being accepted? I tried looking at async_tls' and rustls' documentation but I did not find options for me to accept self signed certificates or other dangerous options that native_tls has.

localacct avatar Sep 16 '20 09:09 localacct

Hi

I tried making some changes to my code but I am still seeing the same error, not sure where it went wrong.

	let mut customroot = rustls::RootCertStore::empty();

	let mut serverpem = File::open("custom_ca.pem")?;
	let mut serverpem = BufReader::new(serverpem);

	let der_formatted = rustls::internal::pemfile::certs(&mut serverpem).unwrap();

	for server_ca in &der_formatted
	{
		customroot.add(server_ca);
	}

	let mut clientconfig = rustls::ClientConfig::new();
        clientconfig.enable_sni = false;
        clientconfig.root_store = customroot;

        let async_connector = async_tls::TlsConnector::from(clientconfig);

	let tcp_stream = async_std::net::TcpStream::connect("127.0.0.1:4444").await?;
        let encrypted_stream = async_connector.connect("127.0.0.1:4444", tcp_stream).await?;

localacct avatar Sep 17 '20 10:09 localacct

I sadly have no ncat at hand - is this also when just using rusttls directly?

skade avatar Dec 04 '20 19:12 skade