CRYPTO_INIT success without valid certificate

Post here your questions about SFS2X. Here we discuss all server-side matters. For client API questions see the dedicated forums.

Moderators: Lapo, Bax

User avatar
Metlmeta
Posts: 9
Joined: 23 Jul 2021, 22:58

CRYPTO_INIT success without valid certificate

Postby Metlmeta » 06 Oct 2021, 15:51

Hello,

A few months ago I installed an SSL certificate on my public server and successfully setup zone encryption. My SSL certificate expired recently and the websocket client was no longer able to connect as expected, but my non-websocket client was still able to connect.

The non-websocket client connects through the default port and successfully initializes the cryptkey manager sever-side and is allowed to connect to the zone after firing a successful SFSEvent.CRYPTO_INIT client-side. I'm wondering how this is possible because the documentation mentions that keys are served via HTTPS through the web server.

If I no longer have a valid SSL certificate, how is my non-websocket client still allowed to connect to an encrypted zone?
User avatar
Lapo
Site Admin
Posts: 23008
Joined: 21 Mar 2005, 09:50
Location: Italy

Re: CRYPTO_INIT success without valid certificate

Postby Lapo » 06 Oct 2021, 16:30

Hi,
seems a bit odd. The InitCrypto call definitely uses HTTPS so it should fail with a certificate error... unless the client is suppressing SSL errors on its side, in which case it might still be able to connect although it kind of defeat the purpose (suppressing the error, that is).

Can you give us more details?
What client side API are you using for the non-websocket app?
Also what SFS2X version are you running?

Cheers
Lapo
--
gotoAndPlay()
...addicted to flash games
User avatar
Metlmeta
Posts: 9
Joined: 23 Jul 2021, 22:58

Re: CRYPTO_INIT success without valid certificate

Postby Metlmeta » 06 Oct 2021, 17:19

I'm currently running 2.17.3. My server, outside of SmartFox, is configured to only let my specific IP address connect insecurely through HTTP and port 80. I think what happens is that the HTTPS connection fails client-side, but I'm somehow still allowed to punch through and connect server-side.

I tried using a different client-side IP address to connect to the server and it looks like SmartFox correctly disallows the client to connect. Even if my main server is letting my IP through for HTTP, I still found it odd that SmartFox would also let it through despite not explicitly connecting with an HTTPS connection.

unless the client is suppressing SSL errors on its side, in which case it might still be able to connect although it kind of defeat the purpose

What do you mean by this? Is it possible for a client to ignore a server response and still connect to an encrypted zone even when an SSL isn't working?
User avatar
Lapo
Site Admin
Posts: 23008
Joined: 21 Mar 2005, 09:50
Location: Italy

Re: CRYPTO_INIT success without valid certificate

Postby Lapo » 07 Oct 2021, 09:50

Hi,
Even if my main server is letting my IP through for HTTP, I still found it odd that SmartFox would also let it through despite not explicitly connecting with an HTTPS connection.

Yeah, that sounds weird.
Running an expired SSL certificate is equivalent to not running one, or using a self-signed one. In any of these cases you will get an SSL error and the connection attempt will fail.

Just to refresh my memory I have tested with a Java and a C# client and they both failed as expected, so I am not sure what is happening on your side exactly. We should see all the details and the client code. If you have a reproducible test-case you can send it to our support@... mail box and we'll check it out.

Is it possible for a client to ignore a server response and still connect to an encrypted zone even when an SSL isn't working?

Yes, most client platforms can do that. C# can do it, Java can do it. Javascript/HTML5 can't do it because they depend on the browser's sandbox. But it's not very useful, besides maybe local testing.

NOTE: it's not that they can bypass or circumvent cryptography. They can just silence SSL errors in case a certificate (which is deployed on the server) has issues.

Cheers
Lapo

--

gotoAndPlay()

...addicted to flash games
User avatar
Metlmeta
Posts: 9
Joined: 23 Jul 2021, 22:58

Re: CRYPTO_INIT success without valid certificate

Postby Metlmeta » 17 Oct 2021, 21:13

Hey again and sorry for the late reply. I'm currently helping with the Haxe port, so there may be a problem with the listener response.

What you're saying is that a client can still talk to the server and get a key to encrypt the data, but the fact that it may be unsafe is ignored? So ultimately the client's packet data is still encrypted, despite the security issue. I think I understand the process a bit better.
User avatar
Lapo
Site Admin
Posts: 23008
Joined: 21 Mar 2005, 09:50
Location: Italy

Re: CRYPTO_INIT success without valid certificate

Postby Lapo » 18 Oct 2021, 09:12

What you're saying is that a client can still talk to the server and get a key to encrypt the data, but the fact that it may be unsafe is ignored? So ultimately the client's packet data is still encrypted, despite the security issue. I think I understand the process a bit better.

Yes, that's correct. The risk with this operation is that you are exposed to the man-in-the-middle attack. And that's what a valid certificate is for: to avoid that kind of security problem.

More on this here:
https://en.wikipedia.org/wiki/Man-in-the-middle_attack

cheers
Lapo

--

gotoAndPlay()

...addicted to flash games
User avatar
Metlmeta
Posts: 9
Joined: 23 Jul 2021, 22:58

Re: CRYPTO_INIT success without valid certificate

Postby Metlmeta » 18 Oct 2021, 13:37

Thanks again for the help. So far, so good - I'll create a new topic if this problem crops up again.

Return to “SFS2X Questions”

Who is online

Users browsing this forum: No registered users and 51 guests