0

I am trying to build a light web server on an embedded device, and trying to add HTTPS to it by introducing mbedTLS.

I can use Firefox or IE to make connections without any problem. However, when using Chrome/Chromium/Opera, it creates many TCP connections at first, and try to do SSL handshake. Most of the connections didn't send any ApplicationData after SSL handshake, the browser sends FIN right after ChangeCipherSpec and Finish. Only few connection would send ApplicationData after SSL handshake. It causes many items on a page are not loaded, the server didn't receive GET request for some items.

Cipher suite: RSA_WITH_AES128_GCM_SHA256
Certificate: Self-signed certificate with RSA1024/2048 key
keep-alive is not enabled

Why are so many connections created but not used by Chrome? And any idea to fix it?

Thanks

For StackzOfZtuff

Here is the screenshot of Chrome dev tool, it shows some certificate error, which is because the certificate is self-signed. Chrome dev tool

For Tom

SSLLabs result: The main issues are: (A) RSA key length 1024 is weak (B) Self-signed certificate issue (C) Forward secrecy not support SSLLabs Result: Certificate SSLLabs Result: Configuration SSLLabs Result: Protocol detail 1 SSLLabs Result: Protocol detail 2

For Baptiste

I tried to disable "QUIC protocol", but I still got the issue of Chromes sends FIN after SSL handshake.

Liang Changwei
  • 11
  • 4

2 Answers2

1

Thanks for StackzOfZtuff's help, I found the problem finally.

While connecting to a server with a self-signed certificate, the Chrome would show "Your connection is private", and we can keep going by clicking "Advanced" and "Proceed to XXX". However, even the website is loaded, but the chrome would create many SSL connections and disconnect some of them after handshake finish.

By analyzing the Chrome event by "chrome://net-export" and "chrome://net-internal", it shows the socket is closed after SSL handshake and an error "ERR_CERT_AUTHORITY_INVALID" shows.

I tried to disable the SAN(Subject Alternative Name) check of Chrome first (because my mbedTLS doesn't support creating a certificate with SAN now) and import the certificate manually to Chrome, then the Chrome can connect to my httpd without certificate warning message and the Chrome would no more drop the connection.

Liang Changwei
  • 11
  • 4
0

"Subject Alternative Name missing"

Chrome requires SAN and no longer supports CommonName.

See: ChromeStatus, Support for commonName matching in Certificates (removed)

Add a SAN name to your cert to fix this.

Community
  • 1
StackzOfZtuff
  • 17,783
  • 1
  • 50
  • 86