The committed cert/key pair used for the local HTTPS listener don't
correspond to each other:
$ openssl x509 -noout -modulus -in fullchain.pem | openssl md5
MD5(stdin)= baf59ff7f5b05fde6799439b6f31a290
$ openssl rsa -noout -modulus -in privkey.pem | openssl md5
MD5(stdin)= 6040b29ebb87a96fe4465dfbc6f04b1c
Since these are `include_str!`'d directly into the binary
(`crates/unlocker-helper/src/servers.rs`), this makes `rustls::ServerConfig`
construction fail unconditionally with `InconsistentKeys::KeyMismatch` for
anyone building from a fresh clone — the HTTPS listener can never come up.
Might be worth checking `git log` on these two files to see if one was
rotated without the other. I generated a throwaway self-signed replacement
locally (SANs: api-prod.xteink.cc, api-prod.xteink.cn, api.github.com,
unlocker.crosspointreader.com, franssjz.github.io) to unblock myself, but
the actual fix presumably needs the maintainers' real key.
The committed cert/key pair used for the local HTTPS listener don't
correspond to each other:
$ openssl x509 -noout -modulus -in fullchain.pem | openssl md5
MD5(stdin)= baf59ff7f5b05fde6799439b6f31a290
$ openssl rsa -noout -modulus -in privkey.pem | openssl md5
MD5(stdin)= 6040b29ebb87a96fe4465dfbc6f04b1c
Since these are `include_str!`'d directly into the binary
(`crates/unlocker-helper/src/servers.rs`), this makes `rustls::ServerConfig`
construction fail unconditionally with `InconsistentKeys::KeyMismatch` for
anyone building from a fresh clone — the HTTPS listener can never come up.
Might be worth checking `git log` on these two files to see if one was
rotated without the other. I generated a throwaway self-signed replacement
locally (SANs: api-prod.xteink.cc, api-prod.xteink.cn, api.github.com,
unlocker.crosspointreader.com, franssjz.github.io) to unblock myself, but
the actual fix presumably needs the maintainers' real key.