ERR_QUIC_PROTOCOL_ERROR.QUIC_TLS_CERTIFICATE_UNKNOWN (TLS handshake failure (ENCRYPTION_HANDSHAKE) 46: certificate unknown).

[JatosDetking]

When I ran the server locally there was no problem. But after the deployment of ec2 it appeared and it no longer connects to web transport.

Failed to establish a connection to https://kldfglkdshgkdhfsk/socket.io/: net::ERR_QUIC_PROTOCOL_ERROR.QUIC_TLS_CERTIFICATE_UNKNOWN (TLS handshake failure (ENCRYPTION_HANDSHAKE) 46: certificate unknown).

I start my browser with this command
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --origin-to-force-quic-on=https://kldfglkdshgkdhfsk --ignore-certificate-errors-spki-list=rifgjkerwiogi9u0jfiojwod=

I have generated the certificates with
openssl req -new -x509 -nodes
-out cert.pem
-keyout key.pem
-newkey ec
-pkeyopt ec_paramgen_curve:prime256v1
-subj '/CN=0.0.0.0'
-days 14

[darrachequesne]

Hi!

Shouldn't the common name be kldfglkdshgkdhfsk instead of 0.0.0.0 when creating the certificate?

[JatosDetking]

I tried what you said and it gave the same error again.

[JatosDetking]

do you have any other idea

[darrachequesne]

No. Unfortunately, it's currently quite hard to debug those problems, as the browser does not provide much information.

[allanlei]

The problem was solved for me with GoogleChrome/samples#697 (comment), though I didn't need to use this part

Moreover, it has to be a non-existent directory every time. Reusing an existing directory would not work.

Cert was generated via mkcrt: mkcrt localhost

#!/bin/bash
HASH=`openssl x509 -pubkey -noout -in localhost.pem |
    openssl pkey -pubin -outform der |
    openssl dgst -sha256 -binary |
    base64`

'/Applications/Google Chrome.app/Contents/MacOS/Google Chrome' \
    --ignore-certificate-errors-spki-list=$HASH \
    --origin-to-force-quic-on=127.0.0.1:3000 \
    --user-data-dir=.\quic-userdata \
    https://localhost:3000