#gnutls — Public Fediverse posts

I'm clearly old and stupid. I can't figure out how to submit an issue for #GnuTLS on their gitlab anymore. (I did in the past.)

So here it comes instead: gnutls_certificate_verify_peers2() does not seem to verify ExtendedKeyUsage but gnutls_certificate_verify_peers() does.

Neither case is documented clearly. This has already lead to people submitting vuln reports to gnutls-using apps for this omission.

@bagder I'm hearing similar things from both #OpenSSL and #GnuTLS.

RE: https://mamot.fr/@smortex/116219434637755665

Request for help

I am stuck trying to identify the root cause of an issue with a program using #GnuTLS to communicate with a #Java service. It stopped working last summer when updating from OpenJDK 17.0.16+8-1 to 17.0.17~5ea-1 (Debian 12 packages). It also fail with all newer versions of OpenJDK.

I am not sure if this is caused by a misuse of the GnuTLS API, a regression in OpenJDK or an issue with GnuTLS itself.

Boosts appreciated! Thanks!

#fedihelp

1/6

I'm investigating a regression that appeared after upgrading #OpenJDK in a setup where #syslog_ng communicates with a #Riemann server (a Java application).

My investigation led me to a C library (riemann-c-client, used by syslog-ng) that uses #GnuTLS to establish a mutually authenticated TLS connection to the Java service. The library provides a CLI utility that allows me to reproduce the problem, which suggests that the issue lies in this library rather than in syslog-ng itself.

If you're using #GnuTLS please note that GnuTLS defaults to weak security profile:

"The message authenticity security level is of 64 bits or more, and the certificate verification profile is set to GNUTLS_PROFILE_LOW (80-bits)."

This means for example that Diffie-Hellman group size of 1024-bits is allowed. This was deemed insufficient already 10 years ago. See https://weakdh.org/

This issue will be remedied in future GnuTLS release. Meanwhile the fix is to inject %PROFILE_MEDIUM as part of the priority string, for example "NORMAL:foo" becomes "NORMAL:%PROFILE_MEDIUM:foo". See https://gnutls.org/manual/html_node/Priority-Strings.html for details.

#insecuredefaults #cybersecurity #infosec #development

It's not just @bagder who gets incorrect bug reports generated by #AI for #curl. This time, it's #GnuTLS at https://gitlab.com/gnutls/gnutls/-/issues/1711.

What a waste of time :/

#apt-listchanges: News
---------------------

#curl (8.13.0-2) unstable; urgency=medium

The curl #CLI is now back to using #OpenSSL, instead of #GnuTLS:
HTTP/3 support is still there, compared to the GnuTLS curl CLI.
The performance of HTTP/3 on OpenSSL is not as good, but it's also not used
by default.

-- Samuel Henrique <[email protected]> Sun, 06 Apr 2025 22:13:18 +0100

#Linux #Debian 13 #Trixie news

While updating my #Debian Trixie desktop, I note several packages changing from #GnuTLS to #OpenSSL. Is there a reason for this?

I thought people were trying to get away from OpenSSL over issues with complexity and bugs.

How To Install Curl With GnuTLS Backend In Debian #Curl #Gnutls #Backend #Debian #Gnustow #Linux #Linuxhowto
https://ostechnix.com/install-curl-with-gnutls-backend-in-debian/

Debian Curl Now Supports HTTP3: Here's What You Need To Know #Debian #Curl #HTTP3 #OpenSSL #GnuTLS #Decurity #Linux
https://ostechnix.com/debian-curl-supports-http3/

of COURSE the memory corruption bug x509-limbo found was in #GnuTLS. #PyConUS #PyCon2024

Brought to you by #strace-ing sssd to the connect(), getrandom(), and few read()/write() calls before switching to #GnuTLS localization files to get the “error message”, where it became obvious no actual certificates were being checked locally… Then checking #sssd's source code, diving into the #openldap rabbit hole and its dedicated config file, ending with:

# TLS certificates (needed for GnuTLS)
TLS_CACERT /etc/ssl/certs/ca-certificates.crt

#GnuTLS 3.8.3 has been released (#SSL / #TLS / #TLS13 / #DTLS / #Security) https://gnutls.org/

My emacs is failing to negotiate addresses that always worked before, though Curl does just fine by them. Errors indicate that #gnutls might be the problem. I wonder what happened and if more will break if I update it... #guix

WTF? #gnutls|-cli
[ ... ]
Validity:
[ ... ]
Not After: Thu Sep 30 14:01:15 UTC 2021
[ ... ]
Status: The certificate is trusted.

Aeh - No ... This is expired - its by definition not trusted.

#GnuTLS debug client 3.7.3
Checking 10.0.0.180:9001
whether the server accepts default record size (512 bytes)... no
whether %ALLOW_SMALL_RECORDS is required... no
whether we need to disable TLS 1.2... yes
whether we need to disable TLS 1.1... yes
whether we need to disable TLS 1.0... yes
whether %NO_EXTENSIONS is required... skipped
whether %COMPAT is required... skipped
for TLS 1.0 (RFC2246) support... no
for TLS 1.0 (RFC2246) support with TLS 1.0 record version... no
for TLS 1.1 (RFC4346) support... no
fallback from TLS 1.1 to... failed
for TLS 1.2 (RFC5246) support... no
for TLS 1.3 (RFC8446) support... no
for known TLS or SSL protocols support... no

Plenty of new APIs added to Guile GnuTLS beta version 3.7.13, please give us feedback before the next stable release! #guile #gnutls https://lists.gnutls.org/pipermail/gnutls-help/2023-July/004832.html

It turns out that the problem is in fact due to #macOS Ventura. But it's not in #Emacs nor in #gnutls, but in #gmplib… With the patch applied, everything works fine now.

https://stackoverflow.com/a/75665967