On Tue, Apr 05, 2016 at 09:01:10PM +0100, Alex Bligh wrote: > When I attempt to connect via TLS like this (using today's qemu master): > > ./qemu-img info --object > tls-creds-x509,id=tls0,dir=../certs,endpoint=client --image-opts > driver=nbd,host=127.0.0.1,port=6666,export=foo,tls-creds=tls0 > > (command line from Daniel over IRC) > > I get the rather opaque error: > > qemu-img: Unable to initialize certificate > > and with the patch I sent through I get the not much less opaque error: > > qemu-img: Unable to initialize certificate: ASN1 parser: Element was not > found. > > gdb indicates this is crypto/tlscredsx509.c:399 where > gnutls_x509_crt_init(&cert) fails. > > I generated the certificates EXACTLY as per: > http://qemu.weilnetz.de/qemu-doc.html#vnc_005fgenerate_005fcert > (also from Daniel over IRC) > > and the certificates work fine with gnutls-cli and gnutls-server > > I am compiling on and running on Ubuntu Trusty 14.04, and have an up to date > (for 14.04) gnutls installed. > > $ dpkg --list | fgrep libgnutls26 > ii libgnutls26:amd64 2.12.23-12ubuntu2.4 amd64 GNU TLS library - runtime > library > > All the certificates are at: > https://gist.github.com/abligh/96425e20fb423d847b8fd4ead298efed > (no there's nothing secret there)
I've just tested using your certs and they work correctly for me. I have gnutls-3.4.10-1.fc23.x86_64 on Fedora 23, so either there's something broken with gnutls 2.x compatibility in general, or there's a specific bug in your exact version of gnutls. I'll try and investigate further Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
