Forums Read-only archive

Does Brekeke support elliptic curve certificates

7 posts · Brekeke SIP Server Forum

deeprock2 Original post
1. Brekeke Product Name and Version:
3.9.2
2. Java version:
1.8
3. OS type and the version:
Ubuntu 18.04
4. UA (phone), gateway or other hardware/software involved:
pjpsip
5. Your problem:
Does Brekeke support Elliptic Curve certificates? I am able to generate RSA certificates with OpenSSL and it successfully worked with Brekeke Server. But I couldn't load Elliptic Curve certificates. The only error message I get was :

Code: 

Exception:
java.security.spec.InvalidKeySpecException
invalid key format
Harold
A key file format must be RSA format.
Let you convert your key file to RSA formatted file.

For example:
openssl rsa -in current.key -out rsa.key

Also, make sure you upload the key file at [Private Key File] field.
and upload the certificate file at [Certificate File] field.
deeprock2
Because my private key is in elliptic curve private format, your suggestion did not work. Let me explain what I did :

First I created a private key for CA:

Code: 

openssl ecparam -out ca.key -name secp521r1 -genkey -rand /dev/urandom
Then CA signed its certificate(self-signed CA certificte)

Code: 

openssl req -x509 -new -key ca.key -out ca.pem -outform PEM -days 3650 -sha384
Generate a key for Brekeke SIP server

Code: 

openssl ecparam -out sip.key -name secp521r1 -genkey -rand /dev/urandom
Generate sign request for SIP

Code: 

openssl req -new -nodes -key sip.key -outform PEM -out sip.req -sha384
Sign the request using CA

Code: 

openssl ca -keyfile ca.key -cert ca.pem -in sip.req -out sip.pem -outdir . -days 3650
At this step, I have sip.key and sip.pem for Brekeke SIP server. But Brekeke does not like private key and gives the error message that I mentioned in my first message.(Invalid key format)

Does that mean Brekeke supports only RSA certificates? I want to use ECDSA, not RSA, therefore my key should be EC key.

On the other hand, The output of the "ciphersuitesinfo" command contains my desired ciphersuit which is TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256.

Harold wrote:A key file format must be RSA format.
Let you convert your key file to RSA formatted file.

For example:
openssl rsa -in current.key -out rsa.key

Also, make sure you upload the key file at [Private Key File] field.
and upload the certificate file at [Certificate File] field.
[/b][/quote]
Mike
Can you make a PKCS#12 file or JKS from these key and certificate file?

And then select such a file type at [File Type] setting.
Mike
For converting sip.key and sip.pem to sip.p12, try the command like this.

Code: 

openssl pkcs12 -export -out sip.p12 -inkey sip.key -in sip.pem -certfile ca.pem
Then select "PKCS#12" at [File Type] setting in the SIP Server, and upload sip.p12 file.

If you execute the "certinfo" command at the SIP Server, you can confirm that Key Algorithm is EC.
deeprock2
Thank you, that is worked.

Mike wrote:For converting sip.key and sip.pem to sip.p12, try the command like this.

Code: 

openssl pkcs12 -export -out sip.p12 -inkey sip.key -in sip.pem -certfile ca.pem
Then select "PKCS#12" at [File Type] setting in the SIP Server, and upload sip.p12 file.

If you execute the "certinfo" command at the SIP Server, you can confirm that Key Algorithm is EC.
Mike
Glad to know it!