ConfigurationLoadCredential failed

[yc1997427]

Hi, I tried to run sample code to run server, with command ./quicsample -server -cert_file:~/quic/msquic/certs/out/leaf_cert.pem -key_file:~/quic/msquic/certs/out/leaf_cert.pkcs8.

But kept getting error ConfigurationLoadCredential failed, 0xbebc212!
leaf_cert.pem and leaf_cert.pkcs8 are files I generated from google generate_certficate code.

[ThadHouse]

Just to verify, you're running linux, right? And do you have the exact code you used to generate a certificate? That way we can try reproducing the issue. Its possible its an issue with the certificate.

[yc1997427]

Yes, I'm running on Ubuntu 18.04. I used https://chromium.googlesource.com/chromium/src/+/master/net/tools/quic/certs/generate-certs.sh. The google script to generate certs and key.

[yc1997427]

I think it would be very helpful if msquic can provide example cert and key which can be used immediately. Quiche has these, which makes it much easier to run the tests.

[ThadHouse]

I agree. I'll look into this to see if we can make that experience better.

[ThadHouse]

So the reason that script doesn't work is currently msquic does not support certificates with a pass phrase, and that script won't let me generate a key without one.

The following openssl command was able to create a certificate that was usable from msquic, and I could connect to.

[okbaswc]

What exactly is the right way to generate the certificates on Windows for these two files? I've tried the Google script mentioned above as well as doing it the New-SelfSignedCertificate way and exporting/extracting cert and private key with OpenSSL, and nothing seems to work. On Windows, what 2 files are expected as input here?

[ThadHouse]

For windows schannel, using files is not supported, and the certificate store must be used. For windows openssl, we added support recently to use the cert store as well. The only requirement is that when the cert is created or imported, its marked as exportable. Then you just can pass in the thumbprint. That is our recommended way. Otherwise, I believe that you would need to generate Linux style certs to pass into openssl as files. There likely are ways to convert a windows cert to a Linux openssl cert, but I don't have any recommendations.

[ThadHouse]

#1151 adds some documentation on the sample on how to create self signed certificates for both Linux and Windows, for OpenSSL and Schannel providers. Hopefully that helps with some of these issues, and allows creating certificates that are known to work.

[ThadHouse]

Ok, Powershell is actually expanding ~ before starting the application. So its passing to OpenSSL the full path. However, bash is not expanding it, and its likely OpenSSL internally doesn't do expansion when attempting to look up paths. I'll take a look, but there likely nothing we could do from our end, other then to document that full paths must be used.

[ThadHouse]

I just added the following lines at line 410 of the sample. If you add them and build, what extra prints? Just want to make sure it is getting a path that exists.

        printf("Cert File: %s\n", Cert);
        printf("Key File: %s\n", KeyFile);

[yc1997427]

Oh, it works now. I moved the files to the sample script directory, no need to put full path.

[ThadHouse]

Awesome. Glad its working. We just pass the paths directly to OpenSSL, which internally does all the file handling. I'm not sure if they have any documentation on any restrictions for that. But glad we got it working.

[yc1997427]

Just wondering what kind of value we need to put in the sample code to specify the IP address we want to set the server to. I tried to add "192.168.0.1" to address varible, but throwing out error. I'm intending to host the server into a network namespace, with the specifid address

[Wilson-Ian]

I add the info here about how to make it work.
#1092 (comment)