Search code examples
javasslbouncycastledtls

How to implements the method getRSASignerCredentials() for DefaultTlsServer with BouncyCastle

My current Java code with library bctls-jdk18on-1.72.jar for an implementation of TlsServer look like:

class DefaultTlsServerImpl extends DefaultTlsServer {
    ...
    @Override
    protected TlsCredentialedSigner getRSASignerCredentials() throws IOException {
        TlsCryptoParameters cryptoParams = new TlsCryptoParameters(context);
        SignatureAndHashAlgorithm signatureAndHashAlgorithm = null;
        if (TlsUtils.isSignatureAlgorithmsExtensionAllowed(context.getServerVersion())) {
            signatureAndHashAlgorithm = new SignatureAndHashAlgorithm(HashAlgorithm.sha256, SignatureAlgorithm.rsa);
        }
        return new BcDefaultTlsCredentialedSigner(cryptoParams, BC_TLS_CRYPTO, PRIVATE_KEY, CERTIFICATE, signatureAndHashAlgorithm);
    }
    ...

}

I receive the follow exception after the method getRSASignerCredentials()was called:

org.bouncycastle.tls.TlsFatalAlert: internal_error(80)
    at org.bouncycastle.tls.DTLSServerProtocol.accept(Unknown Source)
    at org.bouncycastle.tls.DTLSServerProtocol.accept(Unknown Source)
    ...
Caused by: java.lang.IllegalStateException: Invalid algorithm: {sha256(4),rsa(1)}
    at org.bouncycastle.tls.crypto.impl.bc.BcTlsDSSSigner.generateRawSignature(Unknown Source)
    at org.bouncycastle.tls.DefaultTlsCredentialedSigner.generateRawSignature(DefaultTlsCredentialedSigner.java:53)
    at org.bouncycastle.tls.TlsUtils.generateServerKeyExchangeSignature(TlsUtils.java:2602)
    at org.bouncycastle.tls.TlsECDHEKeyExchange.generateServerKeyExchange(TlsECDHEKeyExchange.java:79)
    at org.bouncycastle.tls.DTLSServerProtocol.serverHandshake(Unknown Source)
    ... 16 more

That I think the mistake is there. How can I implements correctly the method getRSASignerCredentials()?

PS: If I try:

new SignatureAndHashAlgorithm( HashAlgorithm.sha256, SignatureAlgorithm.ecdsa );

because this is related to the certificate SHA256withECDSA then I receive org.bouncycastle.tls.TlsFatalAlert: illegal_parameter(47)

Solution

  • The exception is saying you're providing a DSA or ECDSA certificate, but it can't use those with the RSA SignatureAlgorithm or with getRSASignerCredentials().

    Generate a RSA certificate and try again. Or keep your ECDSA certificate and instead override getECDsaSignerCredentials() and try again.