@@ -46,7 +46,7 @@ version of OTP was indeed the guilty party.
46
46
Since I'm not an expert on certificate validation in Erlang, the error message
47
47
we got when making requests to the bank looks cryptic:
48
48
49
- ```
49
+ ``` text
50
50
TLS :client: In state :wait_cert_cr at ssl_handshake.erl:2123 generated CLIENT ALERT: Fatal - Unsupported Certificate
51
51
- {:key_usage_mismatch,
52
52
{ {:Extension, {2, 5, 29, 15}, true, [:keyCertSign, :cRLSign]},
@@ -87,8 +87,10 @@ identity. Each certificate contains:
87
87
Certificates have "extensions" that specify what they can be used for. Two
88
88
important ones are:
89
89
90
- * Key Usage (KU): Broadly defines what the certificate's key can do (sign things, encrypt things, etc.)
91
- * Extended Key Usage (EKU): More specifically defines the certificate's purpose (web server authentication, email, etc.)
90
+ * Key Usage (KU): Broadly defines what the certificate's key can do (sign
91
+ things, encrypt things, etc.)
92
+ * Extended Key Usage (EKU): More specifically defines the certificate's purpose
93
+ (web server authentication, email, etc.)
92
94
93
95
## The Bug in OTP
94
96
@@ -97,8 +99,10 @@ actually specified in the certificate standards (RFC 5280).
97
99
98
100
In simple terms:
99
101
100
- * The certificates from certain CAs like Entrust had a flag set indicating they could sign other certificates (keyCertSign)
101
- * They also had flags set saying they could be used for web server authentication
102
+ * The certificates from certain CAs like Entrust had a flag set indicating they
103
+ could sign other certificates (keyCertSign)
104
+ * They also had flags set saying they could be used for web server
105
+ authentication
102
106
* OTP thought these two purposes were contradictory and rejected the certificate
103
107
104
108
It's like if you're qualified as both a teacher and a restaurant chef, but then
@@ -118,9 +122,12 @@ fixed it.
118
122
119
123
A few interesting lessons from this experience:
120
124
121
- 1 . Hidden Complexity: Even mature, well-tested software like Erlang/OTP can have subtle bugs in complex areas like SSL/TLS.
122
- 2 . Implementation vs. Specification: The bug wasn't a coding error but an overly strict interpretation of a technical standard.
123
- 3 . Community Matters: Thanks to the Erlang community for identifying and fixing this issue very quickly.
125
+ 1 . Hidden Complexity: Even mature, well-tested software like Erlang/OTP can have
126
+ subtle bugs in complex areas like SSL/TLS.
127
+ 2 . Implementation vs. Specification: The bug wasn't a coding error but an overly
128
+ strict interpretation of a technical standard.
129
+ 3 . Community Matters: Thanks to the Erlang community for identifying and fixing
130
+ this issue very quickly.
124
131
125
132
## Summary
126
133
0 commit comments