[edk2-devel] SSL handshake in HTTPS boot if the certificate was signed with a root certificate

[jacopo.r00ta@gmail.com]

[-- Attachment #1: Type: text/plain, Size: 1310 bytes --]

Hi there,

I was trying to HTTPs boot a virtual machine with the following scenario:

1) I have a self signed root CA root.crt and then I use it to sign another self signed certificate myip.crt for the IP address X.X.X.X
2) I have an NGINX server configured to use SSL with the myip.crt certificate and its key.
3) I have a UEFI virtual machine configured to HTTPs boot and trust the CA certificate root.crt.

Unfortunately the machine fails in the SSL handshake step and then the UEFI config page is shown again. Using for example curl --cacert root.crt X.X.X.X it works perfectly fine (also forcing curl to use tls 1.2).

In addition to that, if I do not use a root certificate for the server's IP (i.e. I do not build a chain of certificates), the machine boots fine.

Unfortunately I don't have a physical server to make a real test. Is this a missing feature, a bug, or am I doing it completely wrong?

Thank you very much!


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#110111): https://edk2.groups.io/g/devel/message/110111
Mute This Topic: https://groups.io/mt/102201552/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-



[-- Attachment #2: Type: text/html, Size: 1817 bytes --]