FiloSottile / FiloSottile/mkcert

Generated PFX (.p12) not working with Node v17+ due to RC2 cipher

Open
#496 1 comment 2 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
59.6k
Forks
3.1k
PR merge metrics
No merged PRs in 30d

Description

## Environment

* Operating system (including version): macOS 13.1
* mkcert version (from `mkcert -version`): v1.4.4
* Server (where the certificate is loaded): Node.js v18.12.1
* Client (e.g. browser, CLI tool, or script): Node.js CLI (webpack-dev-server@4.11.1)

## What you did

I'm using the webpack dev server, and prefer to use the PFX method as it only creates a single file on the filesystem.

- Installed CA with `mkcert -install`
- Create new PFX with `mkcert -pkcs12 localhost`
- Run webpack with server config for HTTPS and loading the PFX (.p12) file.

Webpack config:
```
devServer: {
server: {
type: 'https',
options: {
pfx: './localhost.p12',
passphrase: 'changeit'
}
}
}
```

## What went wrong

Webpack is unable to serve with the following error:

```
> webpack serve --color --mode development

[webpack-dev-server] SSL certificate: /Users/bart/myapp/node_modules/.cache/webpack-dev-server/server.pem
[webpack-cli] Error: unsupported
at configSecureContext (node:internal/tls/secure-context:277:15)
at Object.createSecureContext (node:_tls_common:117:3)
at Server.setSecureContext (node:_tls_wrap:1352:27)
at Server (node:_tls_wrap:1211:8)
at new Server (node:https:74:3)
at Object.createServer (node:https:112:10)
at Server.createServer (/Users/bart/myapp/node_modules/webpack-dev-server/lib/Server.js:2443:57)
at Server.initialize (/Users/bart/myapp/node_modules/webpack-dev-server/lib/Server.js:1820:10)
at Server.start (/Users/bart/myapp/node_modules/webpack-dev-server/lib/Server.js:3251:16)
at async Command. (/Users/bart/myapp/node_modules/@webpack-cli/serve/lib/index.js:159:21)
```

Searching for the problem led me to this Node.js bug report: https://github.com/nodejs/node/issues/40672

It mentions that RC2 cipher has been disabled since Node 17. The suggested command to list the PFX details confirms the use of the RC2 cipher, see `pbeWithSHA1And40BitRC2-CBC` below.

```sh
$ openssl pkcs12 -info -in localhost.p12 -noout
Enter Import Password:
MAC Iteration 1
MAC verified OK
PKCS7 Encrypted data: pbeWithSHA1And40BitRC2-CBC, Iteration 2048
Certificate bag
Certificate bag
PKCS7 Data
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048
```

Is it possible to generate a PFX without using RC2?

In the meantime, I'm using the PEM files approach instead.

Contributor guide

Open the contributing guide

Research direction

Start at the PKCS#12 generation path invoked by `mkcert -pkcs12`; the issue does not name an implementation file or test. Inspect the generated file with `openssl pkcs12 -info -in localhost.p12 -noout`, then verify that Node.js v17+ can load it through the webpack-dev-server HTTPS configuration without the unsupported-cipher error.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, node.js, webpack
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.