Skip to content

Panic when using nonmatching TLS key/certificate combination #36380

Description

@danopia

Version: Deno 2.9.4

Hello, I was testing some TLS behaviors and when I gave Deno a key from one source and a certificate from a second source, so that they don't match, Deno paniced.

Clearly I asked Deno to do an invalid operation but since it's a panic and "This is a bug in Deno" I figured I'd report regardless.

This is the file I ran:

const fixtureCert = `-----BEGIN CERTIFICATE-----
MIIC7TCCAdWgAwIBAgIUD0Q+lZUpqmvTUxmCbhsPx93hYI4wDQYJKoZIhvcNAQEL
BQAwczELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDVNhbiBGcmFuY2lzY28xCzAJBgNV
BAcTAkNBMRgwFgYDVQQKEw9NeSBDb21wYW55IE5hbWUxEzARBgNVBAsTCk9yZyBV
bml0IDIxEDAOBgNVBAMTB0t1YmUgQ0EwHhcNMTgwMjEzMDc1MzAwWhcNMjMwMjEy
MDc1MzAwWjBCMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNU2FuIEZyYW5jaXNjbzEL
MAkGA1UEBxMCQ0ExDjAMBgNVBAMTBWFkbWluMFkwEwYHKoZIzj0CAQYIKoZIzj0D
AQcDQgAEUHBg7OvKkSprAljQcCcpXFns/pMNDkQJZuooj97A0063ipBrZzbdxTcu
VcBjFNJC/Tn2keNSQP+m9QbQmQfmM6N1MHMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud
JQQMMAoGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFMBq0KJaRKoC
+a8R5la/B8tJahD3MB8GA1UdIwQYMBaAFOuZHF+ex0WLX3UX9LJoFHbI9cPNMA0G
CSqGSIb3DQEBCwUAA4IBAQC47D3zYMTg/C9gOYu20xEmw6eTEhJ1wWG9jSdHM9G8
0F3mD4+bG3skx5kaCgtJ3KqbMSGPJ234Ju9VHCNiyiasZS41a8wuagJ6v5pTItLL
BmQ3OhT2HJZz+lDbsb3jLDzesQ5UCct08/e8ST4hnZUcSrz2geD1hSYQEhadsI87
A+wVAvGfhCyiDUiClA2vwosWfomshkWphRzy+s5zFLuxlBAxj8g2oAbCJfhfJS5A
O8W5Nu+ddO5+7PB+y28Bue1GWABIjytmyLdvic0vkKzZkSzPOwqCT1ofZ9HU56h7
jKOjtBacCcl/7pLgvaA8Ng1qfjQTiveDVfI8rNWiEhRm
-----END CERTIFICATE-----`;

const fixtureKey = `-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgtqnvswtIdNxKy07B
D3Y9vvlpwvSDqWCvyWmWTNea2ImhRANCAATa0LtPPOI+De/uRY1vSxR7gFGSoyja
DZyif/sWujLZWEj6Rc2IEl62VfWQD3GeYCEEKP9qzpOGyO+bHWR98kNd
-----END PRIVATE KEY-----`;

Deno.createHttpClient({
  cert: fixtureCert,
  key: fixtureKey,
});

and the output:

$ > deno run repro.ts

============================================================
Deno has panicked. This is a bug in Deno. Please report this
at https://github.com/denoland/deno/issues/new.
If you can reliably reproduce this panic, include the
reproduction steps and re-run with the RUST_BACKTRACE=1 env
var set and include the backtrace in your report.

Platform: linux x86_64
Version: 2.9.4
Args: ["deno", "run", "repro.ts"]

View stack trace at:
https://panic.deno.com/v2.9.4/x86_64-unknown-linux-gnu/q8168Fu3y68Fkjhw5Dg6gw5Dg5gw5Dg3gw5Dg0gw5Dgn4x5Dg4zu7Dg2pg_DgwiviFA

thread 'main' (18118) panicked at ext/tls/lib.rs:354:8:
invalid client key or certificate: InconsistentKeys(KeyMismatch)
stack backtrace:
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions