I am currently working on implementing MQTT over QUIC in MQTT NIO using swift-nio-quic.
While testing the connection against the EMQX broker (which serves as the reference implementation for MQTT over QUIC), the connection fails during the TLS handshake.
When I pass the CA certificate provided by EMQX to the verificationConfiguration, the connection fails, returning a “Crypto Error 40”, which google/quiche documents as follows: “There was no intersection between the crypto primitives supported by the peer and ourselves.”
The certificate uses SHA-1 with RSA cryptography ( 1.2.840.113549.1.1.5 ).
The same certificate works perfectly fine when using NIOSSL and Network.framework over standard TCP.
The same code in my draft PR connects successfully to another QUIC-capable MQTT broker that does not require a CA certificate.
It was suggested to me that the issue might be due to the fact that swift-tls doesn't currently support RSA encryption.
If this really is the problem, I hope that consideration will be given to implementing support for it, so that the community can develop clients that are compatible with the most widely used servers in the exciting new QUIC ecosystem.
If you need any further information about my code or the issue I’ve encountered, I’m of course happy to help. Thanks in advance!
I am currently working on implementing MQTT over QUIC in MQTT NIO using
swift-nio-quic.While testing the connection against the EMQX broker (which serves as the reference implementation for MQTT over QUIC), the connection fails during the TLS handshake.
When I pass the CA certificate provided by EMQX to the
verificationConfiguration, the connection fails, returning a “Crypto Error 40”, whichgoogle/quichedocuments as follows: “There was no intersection between the crypto primitives supported by the peer and ourselves.”The certificate uses SHA-1 with RSA cryptography ( 1.2.840.113549.1.1.5 ).
The same certificate works perfectly fine when using
NIOSSLandNetwork.frameworkover standard TCP.The same code in my draft PR connects successfully to another QUIC-capable MQTT broker that does not require a CA certificate.
It was suggested to me that the issue might be due to the fact that
swift-tlsdoesn't currently support RSA encryption.If this really is the problem, I hope that consideration will be given to implementing support for it, so that the community can develop clients that are compatible with the most widely used servers in the exciting new QUIC ecosystem.
If you need any further information about my code or the issue I’ve encountered, I’m of course happy to help. Thanks in advance!