-
Notifications
You must be signed in to change notification settings - Fork 40.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Can't use PEM encoded PKCS#8 EC keys with server.ssl.certificate-private-key #35322
Comments
Earlier It was working fine with same configurations |
Hello! How did you create the RSA key? |
Through Letsencrypt site. @mhalbritter |
Could you generate a key pair for us with which we can reproduce the issue? I couldn't find that letsencrypt site you mentioned. Do you mean certbot? |
@mhalbritter Sorry.. yes It is certbot. |
@mhalbritter is this a bug in spring ?? |
I don't know. I didn't managed to get a RSA key generated by certbot yet. If you could provide us one, that would help greatly. |
I just tried it with Java 17 and Spring Boot 3.0.6 / 3.1.0-RC2 / 3.1.0-SNAPSHOT and a certbot generated RSA key and can't reproduce it. |
@mhalbritter Let me check it again.. Could you pls check it with Java 11 and Spring Boot 2.7.7 |
@mhalbritter could you please send me the properties because I am getting the same issue again. |
It works with Java 11 and Spring Boot 2.7.7, too. My properties don't help you, because something is wrong with your private key. Until you upload a sample with which we can reproduce the issue I fear that we can't help you here. |
@mhalbritter I have pasted the privkey.pem and fullchain.pem file as it was not allowing to upload .pem extension files. |
Thanks, I can now reproduce the issue. This key is not a RSA key, its a 256 bit elliptic curve key. That seems like a bug in boot. |
This ZIP file contains a EC 256 bit key and the certificate for it. This leads to the stacktrace from the first comment. It looks like Boot tries to load it as a RSA key, which fails. Looks like that Spring Boot 2.7.x is affected, too:
|
Problem is that in parsers.add(new PemParser(PKCS8_HEADER, PKCS8_FOOTER, "RSA", PKCS8EncodedKeySpec::new)); Which sets the algorithm to RSA. This is not correct in this case, it has to be "EC". Seems we need a more sophisticated logic to parse PKCS#8 keys which are not RSA keys. |
Facing the same issue: |
@mhalbritter when will it be released ?? |
@kumarvijay95 you can find that information yourself by looking at the milestone to which the issue has been assigned (2.7.12 and 3.0.7 for the forward port) and their due dates (18 May). |
Hey @TomerBu: RSA keys work fine, but I doubt you'll find a way to convert the EC key to RSA. Did you get the EC key through certbot, too? Maybe there's an option in certbot to force RSA keys? You can also add the keys into a Java KeyStore, which you can then configure through the properties. That should work with EC keys, as the bug is in our own PEM parser. See this documentation for details. |
Polish and port support for PKCS#8 PEM encoded EC and DSA keys to the buildpack code. See gh-35322
Yes. that's what I did and it works. we can also renew an existing certificate: Thank you! |
Thanks for providing that workaround! |
Getting this issue with spring boot properties:
The text was updated successfully, but these errors were encountered: