Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add :supported_groups to @mint_tls_opts #305

Open
numso opened this issue Mar 13, 2025 · 0 comments
Open

Add :supported_groups to @mint_tls_opts #305

numso opened this issue Mar 13, 2025 · 0 comments

Comments

@numso
Copy link

numso commented Mar 13, 2025

Hello!

tldr; would you be open to a PR that adds :supported_groups to the list of @mint_tls_opts?


I ran into an issue yesterday while trying to configure SSL in Finch. I'm working with a client whose server is misconfigured and is rejecting any SSL handshake that contains :brainpoolP256r1tls13 in the supported_groups for key exchange. Erlang's :ssl module has an option for adjusting the supported_groups.

I'm able to add that option to Finch like so:

config :my_app, Finch,
  name: MyApp.Finch,
  pools: %{
    default: [
      conn_opts: [
        transport_opts: [
          supported_groups: :ssl.groups(:default) -- [:brainpoolP256r1tls13]
        ]
      ]
    ]
  }

This fixes my first problem but introduces a second: Requests to http (not https) origins now fail with a badarg error.

It looks Finch maintains a list of SSL options that should be removed when making an http request. Because :supported_groups is missing from that list, it is passed as an option for http requests which causes the badarg error:

@mint_tls_opts [
:cacertfile,
:ciphers,
:depth,
:eccs,
:hibernate_after,
:partial_chain,
:reuse_sessions,
:secure_renegotiate,
:server_name_indication,
:signature_algs,
:signature_algs_cert,
:verify,
:verify_fun,
:versions
]

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant