Sstrhsrtj

I'm trying to run apache httpd 2.4.6 on CentOS 7.6 with a self-signed certificate signed with an elliptic curve key brainpoolP384t1, but apache is not accepting this as a valid key. I ensured all directives are poiting to the right place. The only problem is with apache not recognizing the key as valid. The key is not encrypted.

When I get to the ssl_error_log file, I get this (using pkcs8):

[Sun Dec 16 15:15:36.020090 2018] [ssl:error] [pid 8379:tid 140184667797632] AH02203: Init: Private key not found
[Sun Dec 16 15:15:36.020246 2018] [ssl:error] [pid 8379:tid 140184667797632] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Sun Dec 16 15:15:36.020297 2018] [ssl:error] [pid 8379:tid 140184667797632] SSL Library Error: error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error
[Sun Dec 16 15:15:36.020327 2018] [ssl:error] [pid 8379:tid 140184667797632] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Sun Dec 16 15:15:36.020356 2018] [ssl:error] [pid 8379:tid 140184667797632] SSL Library Error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error (Type=RSA)
[Sun Dec 16 15:15:36.020386 2018] [ssl:error] [pid 8379:tid 140184667797632] SSL Library Error: error:04093004:rsa routines:OLD_RSA_PRIV_DECODE:RSA lib
[Sun Dec 16 15:15:36.020415 2018] [ssl:error] [pid 8379:tid 140184667797632] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Sun Dec 16 15:15:36.020444 2018] [ssl:error] [pid 8379:tid 140184667797632] SSL Library Error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error (Type=PKCS8_PRIV_KEY_INFO)

without pkcs8

[Mon Dec 17 01:24:47.455770 2018] [ssl:error] [pid 18124:tid 139679037429888] AH02203: Init: Private key not found
[Mon Dec 17 01:24:47.455902 2018] [ssl:error] [pid 18124:tid 139679037429888] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Mon Dec 17 01:24:47.456051 2018] [ssl:error] [pid 18124:tid 139679037429888] SSL Library Error: error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error
[Mon Dec 17 01:24:47.456090 2018] [ssl:error] [pid 18124:tid 139679037429888] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Mon Dec 17 01:24:47.456121 2018] [ssl:error] [pid 18124:tid 139679037429888] SSL Library Error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error (Type=RSA)
[Mon Dec 17 01:24:47.456152 2018] [ssl:error] [pid 18124:tid 139679037429888] SSL Library Error: error:04093004:rsa routines:OLD_RSA_PRIV_DECODE:RSA lib
[Mon Dec 17 01:24:47.456180 2018] [ssl:error] [pid 18124:tid 139679037429888] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Mon Dec 17 01:24:47.456210 2018] [ssl:error] [pid 18124:tid 139679037429888] SSL Library Error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error (Type=PKCS8_PRIV_KEY_INFO)

NOTE: I've ran it with rsa key encrypted with aes-256-cbc, but now I want it with an ec key.

From the error messages it looks like your private key is in a pkcs#8 file. From RFC5958 the private key is likely in DER format:

  Interoperability considerations:



     The PKCS #8 object inside this media type MUST be DER-encoded

     PrivateKeyInfo.

So, you probably need to convert your private key to PEM format:

openssl pkey -inform DER -in key.p8 -outform PEM -out key.pem

It's unclear from your question how you've created your keys and your certs. Here's a simple example that functions on my Debian Buster system.

Create an Elliptic Curve Private Key

openssl ecparam -out ec_key.pem -name brainpoolP384t1 -genkey

openssl pkey -in ec_key.pem -text

-----BEGIN PRIVATE KEY-----

MIG6AgEAMBQGByqGSM49AgEGCSskAwMCCAEBDASBnjCBmwIBAQQwKTnt9uvr1aJS

tXEsz3MCtPbojeYvDKOXm9eEllpsErzSdeBUs0c7kyJYnY00N9pwoWQDYgAED2+w

xryVMzZh/nW6mUx3WxWTjXf02/17sZPpkKHcqtj3TObcA7yjpwNs+PriRBEkiyuU

jbXdeTjr79xTLcElXIvJkEp5vu4qijBQ8CRdqc5BZgGWw0vV84xNtB5xKOpc

-----END PRIVATE KEY-----

Private-Key: (384 bit)

priv:

    29:39:ed:f6:eb:eb:d5:a2:52:b5:71:2c:cf:73:02:

    b4:f6:e8:8d:e6:2f:0c:a3:97:9b:d7:84:96:5a:6c:

    12:bc:d2:75:e0:54:b3:47:3b:93:22:58:9d:8d:34:

    37:da:70

pub:

    04:0f:6f:b0:c6:bc:95:33:36:61:fe:75:ba:99:4c:

    77:5b:15:93:8d:77:f4:db:fd:7b:b1:93:e9:90:a1:

    dc:aa:d8:f7:4c:e6:dc:03:bc:a3:a7:03:6c:f8:fa:

    e2:44:11:24:8b:2b:94:8d:b5:dd:79:38:eb:ef:dc:

    53:2d:c1:25:5c:8b:c9:90:4a:79:be:ee:2a:8a:30:

    50:f0:24:5d:a9:ce:41:66:01:96:c3:4b:d5:f3:8c:

    4d:b4:1e:71:28:ea:5c

ASN1 OID: brainpoolP384t1

It's important to note that this particular curve is not compatible with the majority of browsers or commonly used client software.

So, here's an example of generating a NIST curve EC key, which is compatible with most browsers and commonly used client software.

Create NIST EC Key

openssl ecparam -out ec_key_nist.pem -name secp384r1 -genkey

openssl pkey -in ec_key_nist.pem -text

-----BEGIN PRIVATE KEY-----

MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDB1sa6wudssPDi6sfEg

V7J4xTkn3WF4veaMbcw4GAcL8PUrciXjt5jg8J3wbyvB9ZGhZANiAARLBE/WuM1e

DjYNETD+2oEoej6ZbhDvIRbxqxBBuvVna1hQQW76h3MsavEtBNbkAQZHQ9KZCScg

td5N/OhqQ+K7qXSr7F0KHTp49D9grufK+R6/uNoXtT8yiHO5yAI4lok=

-----END PRIVATE KEY-----

Private-Key: (384 bit)

priv:

    75:b1:ae:b0:b9:db:2c:3c:38:ba:b1:f1:20:57:b2:

    78:c5:39:27:dd:61:78:bd:e6:8c:6d:cc:38:18:07:

    0b:f0:f5:2b:72:25:e3:b7:98:e0:f0:9d:f0:6f:2b:

    c1:f5:91

pub:

    04:4b:04:4f:d6:b8:cd:5e:0e:36:0d:11:30:fe:da:

    81:28:7a:3e:99:6e:10:ef:21:16:f1:ab:10:41:ba:

    f5:67:6b:58:50:41:6e:fa:87:73:2c:6a:f1:2d:04:

    d6:e4:01:06:47:43:d2:99:09:27:20:b5:de:4d:fc:

    e8:6a:43:e2:bb:a9:74:ab:ec:5d:0a:1d:3a:78:f4:

    3f:60:ae:e7:ca:f9:1e:bf:b8:da:17:b5:3f:32:88:

    73:b9:c8:02:38:96:89

ASN1 OID: secp384r1

NIST CURVE: P-384

Create the self-signed server certificate

Once you've got a key generated, the self-signed server cert is a one liner:

openssl req -new -key ec_key.pem -x509 -nodes -days 365 -out cert.pem

After testing with both EC keys, it is confirmed that brainpoolP384t1 is a non-functioning curve for any of my browsers. However, the NIST EC key and cert worked as expected with all my client software.

Tested Software:

1. Brave Browser (0.25.2)


2. Firefox (60.3.0)


3. Sylpheed (3.7.0)


4. Lynx (2.8.9rel.1)