I am trying to configure Janus Gateway and I am experiencing with an issue with my self-signed certificate, see log below
Jan 25 09:50:46 localhost platform: [2018/01/25 09:50:46 EST] [EROR] /api/v4/webrtc/token:WebRTC.Token code=500 rid=7mgqedeejpnt3gginnpj5ikape uid=k7m4t6r663frfqaoo5enspfuqh ip=192.168.20.3 We encountered an error while connecting to the server [details: Post https://192.168.20.140:7889/admin: x509: cannot validate certificate for 192.168.20.140 because it doesn't contain any IP SANs]
My hostname is webrtc, IP address is 192.168.20.140 and local DNS is 192.168.20.1
My understanding is I probably didnd't have the SAN information in my certificate so I modified the command that generates the certificate request by following online tutorials. See my configuration file below.
[ req ]
default_bits = 2048 # RSA key size
encrypt_key = yes # Protect private key
default_md = sha256 # MD to use
utf8 = yes # Input is UTF-8
string_mask = utf8only # Emit UTF-8 strings
prompt = yes # Prompt for DN
distinguished_name = san_dn # DN template
x509_extensions = v3_ca
req_extensions = san_reqext # Desired extensions
x509_extensions = usr_cert
[ san_dn ]
countryName = "1. Country Name (2 letters) (eg, US) "
countryName_max = 2
stateOrProvinceName = "2. State or Province Name (eg, region) "
localityName = "3. Locality Name (eg, city) "
organizationName = "4. Organization Name (eg, company) "
organizationalUnitName = "5. Organizational Unit Name (eg, section) "
commonName = "6. Common Name (eg, full name)"
commonName_max = 64
[ san_reqext ]
subjectKeyIdentifier = hash
basicConstraints = CA:FALSE
keyUsage = critical,digitalSignature
extendedKeyUsage = critical,codeSigning, msCodeInd, msCodeCom
nsCertType = client,server,email,objsign
subjectAltName = @alt_names
[ usr_cert ]
subjectKeyIdentifier = hash
basicConstraints = CA:FALSE
keyUsage = critical,digitalSignature
extendedKeyUsage = critical,codeSigning, msCodeInd, msCodeCom
nsCertType = client,server,email,objsign
authorityKeyIdentifier = keyid,issuer
[ alt_names ]
DNS.0 = localhost
DNS.1 = webrtc
DNS.2 = 192.168.20.140
DNS.3 = 192.168.20.1
Below is the command I use to generate my certificate request
openssl req -new -key ./webrtc_secret.key -config ./san_request.cfg -out ./webrtc.csr
Below is the command I use to generate the certificate using my self-sign CA and generated certificate request
openssl x509 -req -in ./webrtc.csr -CA ./rootCA.pem -CAkey ./rootCA.key -CAcreateserial \
-out ./webrtc.pem -days 365 -sha256
Can you spot anything wrong with my certificate request?
Update 1:
Looks like my generated certificate request has the right information.
Requested Extensions:
X509v3 Subject Key Identifier:
F0:CA:B8:FE:FA:CE:29:CE:0E:CB:01:93:B6:97:96:30:8E:B3:16:DB
X509v3 Basic Constraints:
CA:FALSE
X509v3 Key Usage: critical
Digital Signature
X509v3 Extended Key Usage: critical
Code Signing, Microsoft Individual Code Signing, Microsoft Commercial Code Signing
Netscape Cert Type:
SSL Client, SSL Server, S/MIME, Object Signing
X509v3 Subject Alternative Name:
DNS:localhost, DNS:webrtc, DNS:192.168.20.140, DNS:192.168.20.1
Update 2 So you would think openssl would use all your information from the certificate request when generating the certificate. WRONG! I have to manually specify the extension when generating the self-sign certificate using certificate request. See below example below... This might be the answer. I am going to try it now
openssl x509 -req -in ./webrtc.csr -CA ./rootCA.pem -CAkey ./rootCA.key -CAcreateserial -out ./webrtc.pem -days 365 -sha256 -extfile ./san_ext.cfg -extensions san_reqext
[ req ]
req_extensions = san_reqext # Desired extensions
[ san_reqext ]
subjectAltName = @alt_names
[ alt_names ]
DNS.0 = localhost
DNS.1 = mattermost
IP.0 = 192.168.20.140
IP.1 = 192.168.20.1
Not sure where is the lost of information.
