Trouble using certificates with mirai

[wlandau]

I am gearing up to write crew-side documentation on, https://github.com/shikokuchuo/mirai#ca-signed-certificates, and I read Chapter 1.2 of https://www.feistyduck.com/library/openssl-cookbook/online/. However, I am having trouble supplying a certificate to mirai:

# create a key
openssl genpkey -out fd.key -algorithm RSA -outform PEM -pkeyopt rsa_keygen_bits:2048 -aes-128-cbc

# create certificate signing request (css)
openssl req -new -key fd.key -out fd.csr

# self-sign
openssl x509 -req -days 365 -in fd.csr -signkey fd.key -out fd.crt

# concatenate into a single file
cat fd.crt fd.key >> fd.full

# Run mirai
Rscript -e 'mirai::daemons(url = "wss://127.0.0.1.5000", n = 1L, tls = "fd.full")'

# Result
Error in init_monitor(sockc = sockc, envir = envir) : 
  sync between host and dispatcher/daemon timed out after 5s
Calls: <Anonymous> -> init_monitor
Execution halted

 *** caught segfault ***
address 0x40, cause 'invalid permissions'
An irrecoverable exception occurred. R is aborting now ...
[1]    45407 segmentation fault  Rscript -e 

Also, the README says:

4. When launching daemons, the certificate chain to the CA should be supplied to the ‘tls’ argument of daemon() or launch_remote().

• The certificate chain should comprise multiple certificates, each between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- markers. The first one should be the newly-generated TLS certificate, the same supplied to daemons(), and the final one should be a CA root certificate.

Does the private key still go at the end?

[wlandau]

Also in the README:

3. When setting daemons, the TLS certificate and private key should be provided to the ‘tls’ argument of daemons().

Can I list the file names separately, as in tls = c("fd.crt", "fd.key")?

[wlandau]

Thanks, much appreciated!

NB this workaround appears to work on my Windows machine too, although I had to change the call to system2("R", c("--vanilla", "-e", "print(Sys.getenv('MYENVVAR'))")).

[shikokuchuo]

Great - will you give fdf19a7 a try? I think I have everything covered. The env var is unset both on host and dispatcher. Not inherited by daemons.

[shikokuchuo]

Some minor changes in 6fee88c. Shouldn't affect anything.

[wlandau]

Fantastic, @shikokuchuo. Works great! All my tests pass easily. Thank you so much.

[shikokuchuo]

We seem to make good progress on Fridays!

This seems like a really good mechanism vs. specifying things on the command line, so in 0fab55e I do the same for the cert / private keys shared with dispatcher.

It tests fine. I've run all your tests, including the new crew tls tests. I'll come back and do another round of checks later today, and if all good will submit the new version!