<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p></p>
<div>Hi,</div>
<div><br>
</div>
<div>I am confused about the two different ways I can generate an EC private key and why this is causing me problems with the test s_client s_server applications</div>
<div><br>
</div>
<div><br>
</div>
<div>So, I am using the command below to generate a private key, then using this to create </div>
<div>a certificate to work with openssl s_client s_server.</div>
<div><br>
</div>
<div> openssl ecparam -name secp384r1 -genkey -out privkey.pem <i style="">(1)</i></div>
<div><br>
</div>
<div>I then create the .csr with the following two commands,</div>
<div><br>
</div>
<div>
<div><span style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px;"> </span>openssl req -key privkey.pem -out pub.csr -new
<i style="">(2)</i></div>
<div><span style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px;"> </span>openssl x509 -req -in pub.csr -signkey privkey.pem
-out pub.crt (3)</div>
<br>
</div>
<div>This works with s_server/s_client.</div>
<div><br>
</div>
<div>But, when I generate a key like this:</div>
<div><br>
</div>
<div> openssl genpkey -algorithm ec -pkeyopt ec_paramgen_curve:secp384r1 -out privkey.pem
<i>(4)</i></div>
<div> </div>
<div><br>
</div>
<div>If I now create a signed .crt with (2) and (3) above, then use this pair with openssl s_server </div>
<div>it does not <span style="font-size: 12pt;">negotiate a cipher suite and it doesn't work.</span></div>
<blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;">
<div><span style="font-size: 12pt;"><br>
</span></div>
<div><span style="font-size: 12pt;">
<div style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px;">
Client:</div>
</span></div>
<div><span style="font-size: 12pt;">
<div style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px;">
CONNECTED(00000154)</div>
</span></div>
<div><span style="font-size: 12pt;">
<div style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px;">
2546392219:error:14004410:SSL routines:CONNECT_CR_SRVR_HELLO:sslv3 alert handshake failure:ssl_pkt.c:1205:SSL alert number 40</div>
</span></div>
<div><span style="font-size: 12pt;">
<div style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px;">
2546392219:error:140040E5:SSL routines:CONNECT_CR_SRVR_HELLO:ssl handshake failure:ssl_pkt.c:585:</div>
</span></div>
<div><span style="font-size: 12pt;">
<div style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px;">
...</div>
</span></div>
<div><span style="font-size: 12pt;">
<div style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px;">
<br>
</div>
</span></div>
<div><span style="font-size: 12pt;">
<div style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px;">
Server:</div>
</span></div>
<div><span style="font-size: 12pt;">
<div style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px;">
...</div>
</span></div>
<div><span style="font-size: 12pt;">
<div style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px;">
ERROR</div>
</span></div>
<div><span style="font-size: 12pt;">
<div style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px;">
2867046282:error:140270C1:SSL routines:ACCEPT_SR_CLNT_HELLO_C:no shared cipher:ssl_srvr.c:1024:</div>
</span></div>
<div><span style="font-size: 12pt;">
<div style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px;">
shutting down SSL</div>
</span></div>
<div><span style="font-size: 12pt;">
<div style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px;">
CONNECTION CLOSED</div>
</span></div>
</blockquote>
<div><span style="font-size: 12pt;">
<div><br>
</div>
</span></div>
<div>Using this url (<a href="https://wiki.openssl.org/index.php/Command_Line_Elliptic_Curve_Operations" class="OWAAutoLink" id="LPlnk509524" style="font-size: 12pt;" previewremoved="true">https://wiki.openssl.org/index.php/Command_Line_Elliptic_Curve_Operations</a><span style="font-size: 12pt;">) </span><span style="font-size: 12pt;">It
turns out, if I take the key generated by (4) above, and convert it to pk8 with</span></div>
<div><br>
</div>
<div> openssl pkcs8 -topk8 -nocrypt -in privkey_ec.pem -out privkey.pem</div>
<div><br>
</div>
<div><span style="font-size: 12pt;">If I now use this </span><span style="font-size: 12pt;">key to create the .crt and use this key pair with openssl s_server it works.</span><br>
</div>
<div>My question is why does the format of the private key make any difference. Surely openssl can decode the key in any supported format, after all it created it, and all</div>
<div>the required information must be in it, as it is able to convert to pk8 format that works.</div>
<div><br>
</div>
<div><br>
</div>
<div>Note: </div>
<div><br>
</div>
<div>I am running openssl server/client like this..</div>
<div><br>
</div>
<div>openssl.exe s_server -tls1_2 -key privkey.pem -cert pub.crt -debug</div>
<div><br>
</div>
<div>and</div>
<div><br>
</div>
<div>openssl.exe s_client -tls1_2</div>
<div><br>
</div>
<div>Thanks!</div>
<br>
<p></p>
</div>
</body>
</html>