Description
Chef/Cinc remote_file resource fails to download files from HTTPS servers using ECC certificates on ARM64 macOS M2 processor, while the same recipe works perfectly on x86_64 macOS. The issue is caused by incomplete/broken Elliptic Curve Cryptography support in the ARM64 build of the embedded OpenSSL 1.1.1m.
Investigation
When running the macos.rb recipe for an arm64 macOS agent, the following error appeared: SSL_connect returned=1 errno=0 state=error: certificate verify failed (EE certificate key too weak). When running the exact same recipe on an x86_64 agent, it works fine.
The resource remote_file uses internal OpenSSL libraries from cinc installation. When comparing both versions from x86 and arm architectures, there are different compilation flags:
- x86 has these while arm does not:
-DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DECP_NISTZ256_ASM.
To test the library, we can use the openssl client from embedded cinc and see the output:
/opt/cinc/embedded/bin/openssl s_client -connect github.com:443 -servername github.com
# On x86:
Verification: OK
Verify return code: 0 (ok)
# On arm:
error:1012606B:elliptic curve routines:EC_POINT_set_affine_coordinates:point is not on curve
error:100AF010:elliptic curve routines:ec_group_new_from_data:EC lib
error:100AE081:elliptic curve routines:EC_GROUP_new_by_curve_name:unknown group
error:100D7010:elliptic curve routines:eckey_pub_decode:EC lib
error:1416F0EF:SSL routines:tls_process_server_certificate:unable to find public key parameters
Workarounds
For now, my solution has been using curl, as it uses the system native SSL libraries.
Description
Chef/Cinc
remote_fileresource fails to download files from HTTPS servers using ECC certificates on ARM64 macOS M2 processor, while the same recipe works perfectly on x86_64 macOS. The issue is caused by incomplete/broken Elliptic Curve Cryptography support in the ARM64 build of the embedded OpenSSL 1.1.1m.Investigation
When running the
macos.rbrecipe for an arm64 macOS agent, the following error appeared:SSL_connect returned=1 errno=0 state=error: certificate verify failed (EE certificate key too weak). When running the exact same recipe on an x86_64 agent, it works fine.The resource
remote_fileuses internal OpenSSL libraries from cinc installation. When comparing both versions from x86 and arm architectures, there are different compilation flags:-DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DECP_NISTZ256_ASM.To test the library, we can use the openssl client from embedded cinc and see the output:
Workarounds
For now, my solution has been using
curl, as it uses the system native SSL libraries.