quictransport server certificate problem

[rebelde96]

I am having problem trying to connect to the python server I got from quictransport example.

net::ERR_QUIC_PROTOCOL_ERROR.QUIC_HANDSHAKE_FAILED (TLS handshake failure (ENCRYPTION_HANDSHAKE) 46: certificate unknown).
client.html:1 Uncaught (in promise) TypeError: Connection lost.

I am using letsencrypt certificate on Windows Server. With regular "Hello World" python page, the certificate is working. What can be the reason?

[jeffposnick]

CC: @vasilvv, who may know more about the certificate requirements for the sample.

[yoursunny]

I'm using a certificate generated by OpenSSL following these instructions:

samples/quictransport/quic_transport_server.py

Lines 56 to 75 in 8223e1b

	# 1. Generate a certificate and a private key:
	# openssl req -newkey rsa:2048 -nodes -keyout certificate.key \
	# -x509 -out certificate.pem -subj '/CN=Test Certificate' \
	# -addext "subjectAltName = DNS:localhost"
	#
	# 2. Compute the fingerprint of the certificate:
	# openssl x509 -pubkey -noout -in certificate.pem |
	# openssl rsa -pubin -outform der |
	# openssl dgst -sha256 -binary | base64
	# The result should be a base64-encoded blob that looks like this:
	# "Gi/HIwdiMcPZo2KBjnstF5kQdLI5bPrYJ8i3Vi6Ybck="
	#
	# 3. Pass a flag to Chromium indicating what host and port should be allowed
	# to use the self-signed certificate. For instance, if the host is
	# localhost, and the port is 4433, the flag would be:
	# --origin-to-force-quic-on=localhost:4433
	#
	# 4. Pass a flag to Chromium indicating which certificate needs to be trusted.
	# For the example above, that flag would be:
	# --ignore-certificate-errors-spki-list=Gi/HIwdiMcPZo2KBjnstF5kQdLI5bPrYJ8i3Vi6Ybck=

My localhost is Windows and cannot install aioquic successfully, so I installed that on a Linux server in my LAN and adjusted command lines to reference FQDN of that server, as well as BIND_ADDRESS in the Python script.
Chrome is complaining "You are using an unsupported command-line flag" above the webpage, and the console is indicating 46: certificate unknown.
Wireshark shows 1 QUIC-Initial frame from Chrome, 3 QUIC-Handshake frames from server, and 2 QUIC-Handshake frames from Chrome.

[yoursunny]

https://bugs.chromium.org/p/chromium/issues/detail?id=762819#c5

I don't see --user-data-dir (which has to be set in order for --ignore-certificate-errors-spki-list to be set)

After adding --user-data-dir=.\quic-userdata, it's working.

Moreover, it has to be a non-existent directory every time. Reusing an existing directory would not work.