HTTPS streaming - SSL handshake/certificate issue

[kasperrn]

I have setup a Nginx server (very basic setup using the official container) and can successfully do a rauc install over http and using basic auth. I would like to use certificates and know that the certificates I have created work as I can download the update using e.g. wget.

However, with rauc install --tls-cert=client.crt.pem --tls-key=client.key.pem --tls-ca=server.crt.pem I get the error LastError: Failed to stream bundle https://updateserver/bundle.raucb: failed to configure streaming: server not responding and on the Nginx server I can see the SSL handshake fails (SSL_do_handshake: -1) and the client closes the connection.

The debug information is a bit limited so any inputs on how to further debug or solve the issue (e.g. by a working example) would be highly appreciated.

[jluebbe]

You can increase the log verbosity: https://rauc.readthedocs.io/en/latest/using.html#debugging-rauc

Perhaps look at the communication using Wireshark as well.

[kasperrn]

You can increase the log verbosity: https://rauc.readthedocs.io/en/latest/using.html#debugging-rauc

Perhaps look at the communication using Wireshark as well.

Thanks for the input. This is what I get from journalctl:

May 22 14:38:31 64-dev rauc[335]: installing https://updateserver/bundle.raucb: started
May 22 14:38:31 64-dev rauc[335]: Installation 1ff10720 started  
May 22 14:38:31 64-dev rauc[335]: Remote URI detected, streaming bundle...
May 22 14:38:31 64-dev rauc[335]: installing https://updateserver/bundle.raucb: Checking and mounting bundle...
May 22 14:38:31 64-dev rauc[335]: sending: {'url': <'https://updateserver/bundle.raucb'>, 'key': <'client.key.pem'>, 'info-headers': <@as []>, 'ca': <'server.crt.pem'>, 'cert': <'client.crt.pem'>}
May 22 14:38:31 64-dev rauc-nbd[565]: running as UID 65534, GID 65534
May 22 14:38:31 64-dev rauc-nbd[565]: received: {'url': <'https://updateserver/bundle.raucb'>, 'key': <'client.key.pem'>, 'info-headers': <@as []>, 'ca': <'server.crt.pem'>, 'cert': <'client.crt.pem'>}
May 22 14:38:31 64-dev rauc-nbd[565]: configuring for URL: https://updateserver/bundle.raucb
May 22 14:38:31 64-dev rauc-nbd[565]: request failed: Problem with the local SSL certificate (retrying)
May 22 14:38:32 64-dev rauc-nbd[565]: configuring for URL: https://updateserver/bundle.raucb
May 22 14:38:33 64-dev rauc-nbd[565]: request failed: Problem with the local SSL certificate (retrying)
May 22 14:38:34 64-dev rauc-nbd[565]: configuring for URL: https://updateserver/bundle.raucb
May 22 14:38:34 64-dev rauc-nbd[565]: request failed: Problem with the local SSL certificate (retrying)
May 22 14:38:35 64-dev rauc-nbd[565]: configuring for URL: https://updateserver/bundle.raucb
May 22 14:38:35 64-dev rauc-nbd[565]: request failed: Problem with the local SSL certificate (retrying)
May 22 14:38:36 64-dev rauc-nbd[565]: configuring for URL: https://updateserver/bundle.raucb
May 22 14:38:36 64-dev rauc-nbd[565]: request failed: Problem with the local SSL certificate (retrying)
May 22 14:38:37 64-dev rauc-nbd[565]: configuring for URL: https://updateserver/bundle.raucb
May 22 14:38:37 64-dev rauc-nbd[565]: request failed (no more retries)
May 22 14:38:37 64-dev rauc[335]: received http error 0
May 22 14:38:37 64-dev rauc[335]: nbd server stopping
May 22 14:38:37 64-dev rauc-nbd[565]: exiting nbd server
May 22 14:38:37 64-dev rauc-nbd[565]: nbd server failed with: finish_request failed, shutting down
May 22 14:38:37 64-dev rauc[335]: failed to stop ndb server: failed to stop streaming subprocess: Child process exited with code 1
May 22 14:38:37 64-dev rauc[335]: Installation 1ff10720 failed: Failed to stream bundle https://updateserver/bundle.raucb: failed to configure streaming: server not responding
May 22 14:38:37 64-dev rauc[335]: Failed to stream bundle https://updateserver/bundle.raucb: failed to configure streaming: server not responding
May 22 14:38:37 64-dev rauc[335]: installing https://updateserver/bundle.raucb: Failed to stream bundle https://updateserver/bundle.raucb: failed to configure streaming: server not responding
May 22 14:38:37 64-dev rauc[335]: installing https://updateserver/bundle.raucb: finished
May 22 14:38:37 64-dev rauc[335]: installing `https://updateserver/bundle.raucb` failed: 1

Also, I am using a self-signed root certificate and some intermediate certificates for both the server and client. I have tried several combinations in order to check if this could be the issue, but without any luck, even though it works fine with wget. The log says Problem with the local SSL certificate which I assume means client.crt.pem in this case, but it does not say what is wrong with the certificate.

Perhaps, if someone has a working HTTPS streaming setup with certificates they can share a basic example on how to make this work?

[ejoerns]

@kasperrn Did you also set RAUC_CURL_VERBOSE? https://rauc.readthedocs.io/en/latest/using.html#enabling-verbose-curl-output

Which libcurl version do you use?

[kasperrn]

It seems to be libcurl 4.7 (from 1998!). I'll try to upgrade and see if it helps.

[jluebbe]

In that case, you should probably also check your OpenSSL version.