TLS init failing on set_tls_parms

[NAs3c]

Hi everyone,

I am trying to setup beef with TLS, and modified config.yaml as follows :

        public:
            host: "xxx.yyy.zzz" # public hostname/IP address
            port: "443" # public port (443 if the public server is using HTTPS)
            https: true # true/false
...
        https:
            enable: true
            # In production environments, be sure to use a valid certificate signed for the value
            # used in beef.http.public (the domain name of the server where you run BeEF)
            key: "privkey.pem"
            cert: "fullchain.pem"

privkey.pem and fullchain.pem is a valid Let's Encrypt certificate. The framework initialises then when I try to connect to any endpoint, it fails with the following error :

The ruby stacktrace is as follow :

Any idea what is going on ?

[kaitozaw]

Thanks for reporting this issue.

The official install script (used for native Linux and macOS installations) does not seem to be affected. However, this issue appears to be specific to the Docker-based setup, which is the recommended approach for macOS.

I’m assuming you are setting up BeEF on macOS using the Docker instructions from the wiki:
https://github.com/beefproject/beef/wiki/Docker-Setup

I was able to reproduce the same error on macOS by building the current master branch Dockerfile. After investigating, the root cause appears to be that EventMachine is built without TLS support inside the Docker image.

Specifically, bundle install is executed in the Docker builder stage without OpenSSL development headers, causing EventMachine to be compiled without SSL/TLS support. Adding libssl-dev to the builder stage resolves the issue, and the TLS error no longer occurs.

Could you please check whether adding libssl-dev to the Docker builder stage also fixes the problem in your environment?
If you are using the install script instead of Docker, please let me know.

 RUN echo "gem: --no-ri --no-rdoc" > /etc/gemrc \
  && apt-get update \
  && apt-get install -y --no-install-recommends \
     git \
     curl \
+   libssl-dev \
     xz-utils \
     pkg-config \

[NAs3c]

I do use the Docker version on a Kali Linux distribution (Debian) and I confirm your solution works 👍

I now encounter another problem, that I know is a known issue but I did not find a solution except "Use the @ip address", which is not satisfying as for the certificate to be trusted by target browers, it has to match the host name :

Could you point me to a solution ?

[kaitozaw]

Thanks for confirming the Docker fix works 👍

The “Host not permitted” message is a separate configuration issue. Please ensure that:

• beef.http.public.host/port/https in config.yaml match the external hostname you are using
• The TLS certificate CN/SAN matches the same hostname
• You access the hook via https://<public.host>/hook.js

I’ll close this issue once my Dockerfile fix PR is merged.
If the host validation issue is not resolved after that, please open a new issue with your relevant config.yaml and access details.