Update self-signed certificate (should contain 2048 bits key length)

[ebussieres]

Default self-signed certificate has a key of only 1024 bits

openssl rsa -in key.pem -text -noout | grep "Private-Key"
RSA Private-Key: (1024 bit, 2 primes)

While trying to run it, I got an error telling me that the key is too small. I think that certificates should use at least 2048 bits which is now the default and required value.

[0] node:internal/tls/secure-context:65
[0]     context.setCert(cert);
[0]             ^
[0]
[0] Error: error:140AB18F:SSL routines:SSL_CTX_use_certificate:ee key too small
[0]     at node:internal/tls/secure-context:65:13
[0]     at Array.forEach (<anonymous>)
[0]     at setCerts (node:internal/tls/secure-context:63:3)
[0]     at configSecureContext (node:internal/tls/secure-context:152:5)
[0]     at Object.createSecureContext (node:_tls_common:117:3)
[0]     at Server.setSecureContext (node:_tls_wrap:1344:27)
[0]     at Server (node:_tls_wrap:1203:8)
[0]     at new Server (node:https:69:3)
[0]     at Object.createServer (node:https:105:10)
[0]     at /app/node_modules/stubby/src/main.js:105:28 {
[0]   library: 'SSL routines',
[0]   function: 'SSL_CTX_use_certificate',
[0]   reason: 'ee key too small',
[0]   code: 'ERR_SSL_EE_KEY_TOO_SMALL'
[0] }

Is it possible to regenerate it ?
Thanks

[Brian-Farias-BA]

do you solve this error?

[ebussieres]

Well I generated a self signed certificate and I use it in command line instead of using the default one

stubby -d endpoints.yml -l localhost -w -c src/mock/tls/cert.pem -k src/mock/tls/key.pem

[jithinvmohan]

Hi @mrak,
Can you update the certificates? We get this error even when HTTPS is not used.

[mrak]

What error are you actually getting? It should be a 4096-bit cert with sha256 and valid until 2031.

$ openssl rsa -in tls/key.pem -text -noout | grep "Private-Key"
Private-Key: (4096 bit, 2 primes)
$ openssl x509 -noout -text < tls/cert.pem | grep -Ei '(algorithm|bit)'
        Signature Algorithm: sha256WithRSAEncryption
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
    Signature Algorithm: sha256WithRSAEncryption
$ openssl x509 -noout -dates < tls/cert.pem
notBefore=Mar 26 17:38:15 2021 GMT
notAfter=Mar 24 17:38:15 2031 GMT