SSL/TLS does not work with DSA server certificates #12

New Issue

2026-10-05T03:53:44+02:00

adam commented

2026-10-05 03:53:44 +02:00

When using SSL/TLS, a server has the option of presenting a certificate containing either an RSA key or a DSA key. The use of DSA keys is more secure in SSL/TLS, because DSA permits the use of Diffie-Hellman key negotiation and its corresponding Perfect Forward Secrecy, while RSA does not (in theory, there is no reason why an RSA key can't be used to sign an ephemeral DH public key, and indeed PGP does this, but SSL/TLS does not support this mode of operation). Thus, DSA keys are potentially more secure when used with SSL/TLS than RSA keys.

However, ZNC does not currently permit the use of DSA server keys (although the server will start up fine, any attempt to connect to it will fail). This is because, in order to use ephemeral DH, the SSL context needs to have DH parameters attached. The parameters are slow to generate (primality testing) but can be used forever; individual DH keys are generated very quickly from the parameters and are used for one connection and discarded, thus achieving Perfect Forward Secrecy.

Traditionally, DH parameters would be stored in a file for permanent use. In fact, they can be stored in the same PEM file with the key and certificate. I will attach (if that's possible on Github) a patch that inserts the few lines of code necessary to load DH parameters from the PEM file. If no DH parameters are present, the new code fails silently; thus, there is no effect on existing RSA-based servers which don't have DH parameters at all.

When using SSL/TLS, a server has the option of presenting a certificate containing either an RSA key or a DSA key. The use of DSA keys is more secure in SSL/TLS, because DSA permits the use of Diffie-Hellman key negotiation and its corresponding Perfect Forward Secrecy, while RSA does not (in theory, there is no reason why an RSA key can't be used to sign an ephemeral DH public key, and indeed PGP does this, but SSL/TLS does not support this mode of operation). Thus, DSA keys are potentially more secure when used with SSL/TLS than RSA keys. However, ZNC does not currently permit the use of DSA server keys (although the server will start up fine, any attempt to connect to it will fail). This is because, in order to use ephemeral DH, the SSL context needs to have DH parameters attached. The parameters are slow to generate (primality testing) but can be used forever; individual DH keys are generated very quickly from the parameters and are used for one connection and discarded, thus achieving Perfect Forward Secrecy. Traditionally, DH parameters would be stored in a file for permanent use. In fact, they can be stored in the same PEM file with the key and certificate. I will attach (if that's possible on Github) a patch that inserts the few lines of code necessary to load DH parameters from the PEM file. If no DH parameters are present, the new code fails silently; thus, there is no effect on existing RSA-based servers which don't have DH parameters at all.

adam closed this issue

2026-10-05 03:53:44 +02:00

adam commented

2026-10-05 03:53:45 +02:00

Apparently there's no way to attach a file to a Github issue. I'll paste the patch inline here. If you'd prefer it provided by some other mechanism, tell me and I'll be happy to do that.

diff --git a/Csocket.cpp b/Csocket.cpp
index b2bcf44..3748018 100644
--- a/Csocket.cpp
+++ b/Csocket.cpp
@@ -36,6 +36,7 @@
 #endif /* __NetBSD__ */

 #ifdef HAVE_LIBSSL
+#include <stdio.h>
 #include <openssl/conf.h>
 #include <openssl/engine.h>
 #endif /* HAVE_LIBSSL */
@@ -1273,6 +1274,35 @@ bool Csock::SSLServerSetup()
        return( false );
    }

+   FILE *dhParamsFile = 0;
+   if ( ! ( dhParamsFile = fopen( m_sPemFile.c_str(), "r" ) ) )
+   {
+       CS_DEBUG( "There is a problem with [" << m_sPemFile << "]" );
+       return( false );
+   }
+
+   DH *dhParams = PEM_read_DHparams( dhParamsFile, 0, 0, 0 );
+   fclose( dhParamsFile );
+   dhParamsFile = 0;
+   if ( dhParams )
+   {
+       SSL_CTX_set_options( m_ssl_ctx, SSL_OP_SINGLE_DH_USE );
+       if ( ! SSL_CTX_set_tmp_dh( m_ssl_ctx, dhParams ) )
+       {
+           CS_DEBUG( "Error setting ephemeral DH parameters from [" << m_sPemFile << "]" );
+           SSLErrors( __FILE__, __LINE__ );
+           DH_free( dhParams );
+           dhParams = 0;
+           return( false );
+       }
+       DH_free( dhParams );
+       dhParams = 0;
+   }
+   else
+   {
+       ERR_clear_error();
+   }
+
    if ( SSL_CTX_set_cipher_list( m_ssl_ctx, m_sCipherType.c_str() ) <= 0 )
    {
        CS_DEBUG( "Could not assign cipher [" << m_sCipherType << "]" );

Apparently there's no way to attach a file to a Github issue. I'll paste the patch inline here. If you'd prefer it provided by some other mechanism, tell me and I'll be happy to do that. ``` diff --git a/Csocket.cpp b/Csocket.cpp index b2bcf44..3748018 100644 --- a/Csocket.cpp +++ b/Csocket.cpp @@ -36,6 +36,7 @@ #endif /* __NetBSD__ */ #ifdef HAVE_LIBSSL +#include <stdio.h> #include <openssl/conf.h> #include <openssl/engine.h> #endif /* HAVE_LIBSSL */ @@ -1273,6 +1274,35 @@ bool Csock::SSLServerSetup() return( false ); } + FILE *dhParamsFile = 0; + if ( ! ( dhParamsFile = fopen( m_sPemFile.c_str(), "r" ) ) ) + { + CS_DEBUG( "There is a problem with [" << m_sPemFile << "]" ); + return( false ); + } + + DH *dhParams = PEM_read_DHparams( dhParamsFile, 0, 0, 0 ); + fclose( dhParamsFile ); + dhParamsFile = 0; + if ( dhParams ) + { + SSL_CTX_set_options( m_ssl_ctx, SSL_OP_SINGLE_DH_USE ); + if ( ! SSL_CTX_set_tmp_dh( m_ssl_ctx, dhParams ) ) + { + CS_DEBUG( "Error setting ephemeral DH parameters from [" << m_sPemFile << "]" ); + SSLErrors( __FILE__, __LINE__ ); + DH_free( dhParams ); + dhParams = 0; + return( false ); + } + DH_free( dhParams ); + dhParams = 0; + } + else + { + ERR_clear_error(); + } + if ( SSL_CTX_set_cipher_list( m_ssl_ctx, m_sCipherType.c_str() ) <= 0 ) { CS_DEBUG( "Could not assign cipher [" << m_sCipherType << "]" ); ```

adam commented

2026-10-05 03:53:46 +02:00

Replaced by pull request #46.

Replaced by pull request #46.

adam referenced this issue

2026-10-05 04:16:29 +02:00

znc crashes when a client quits #378

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#12