nds-constrain't: Update post

posts/2020-07-12-nds-constraint.md

@@ -10,13 +10,17 @@ made it possible to connect to alternative online services without ROM patching.
 
 The bug itself is simple: the NDS SSL library does not care whether or not a
 certificate is authorized to act as a certificate authority. This means that
-— with any valid certificate — we can sign whatever we want, even a
-certificate under a false hostname.
+— with any valid certificate — we can sign whatever we want,
+including a certificate under a false hostname.
 
 A guide to using this bug for fun and profit is now available on the
 [official page](https://github.com/KaeruTeam/nds-constraint), which is much
 better written than mine. However, you are free to keep reading this one.
 
+**Update (2020-12-31):** I have corrected some mistakes in this post. There is
+also information at the bottom of this post regarding OpenSSL which is important
+to setting up nds-constrain't properly.
+
 ---
 
 ### Getting the Wii client certificate
@@ -25,8 +29,8 @@ As explained in the [official page](https://github.com/KaeruTeam/nds-constraint)
 for nds-constrain't, the Wii client certificate is signed by Nintendo and
 considered valid. Therefore, we can use it's key to sign whatever we want. You
 _could_ grab it from a Wii, but it is much easier to download it from
-[Larsenv's page](https://larsenv.github.io/NintendoCerts/index.html). You will
-want to use the link labelled "Wii NWC Prod 1", by the way.
+[Larsenv's page](https://larsenv.github.io/NintendoCerts/index.html). Choose the
+"Wii NWC Prod 1" key pair.
 
 ### Converting it to a useable format
 
@@ -41,41 +45,46 @@ files, which I will name NWC.crt and NWC.key.
 
 ### Signing your certificate
 
-Instructions for this are listed on the official GitHub page, but I have copied
-them for reference. If I remember correctly, the DS can only handle the SHA-1
-and MD5 hash formats, so pay attention to the `-sha1` flag.
+Instructions for this are listed on the [official guide](https://github.com/KaeruTeam/nds-constraint).
+I have copied them for reference.
 
 	openssl genrsa -out server.key 1024
 	openssl req -new -key server.key -out server.csr
 	openssl x509 -req -in server.csr -CA NWC.crt -CAkey NWC.key -CAcreateserial -out server.crt -days 3650 -sha1
 
-Your webserver probably wants the certificate chain as well, so let's generate
-that as well.
+NGINX users need to create a file for the certificate chain as well.
 
 	cat server.crt NWC.crt > server-chain.crt
 
-We are ready to rock and roll!
+We are now ready to rock and roll!
 
 ### Using your phony certificate
 
 Once the SSL certificate is installed, you may run into issues connecting with
-your DS. This because your NDS only knows how to use SSLv3, with the SHA-1 or
-MD5 cipher sets. Enabling SSLv3 and SHA-1 isn't always possible with webservers,
-so I recommend using NGINX as a reverse-proxy. To enable DS compatibility for
-NGINX, add the following lines to your NGINX configuration.
+your DS. This because your NDS only knows how to use SSLv3, with either the
+RC4-SHA or RC4-MD5 cipher set. To enable DS compatibility for NGINX, add the
+following lines to your NGINX configuration.
 
 	ssl_protocols SSLv3;
-	ssl_ciphers ECDHE-RSA-AES128-SHA;
+	ssl_ciphers RC4-SHA:RC4-MD5:@SECLEVEL=0;
 
-Most services on Nintendo consoles make liberal use of headers. Because of this,
-some extra options need to be enabled.
+The config settings are nearly identical in Apache.
+
+	SSLProtocol SSLv3
+	SSLCipherSuite RC4-SHA:RC4-MD5:@SECLEVEL=0
+
+Most services for Nintendo consoles make liberal use of headers. Unfortunately,
+some headers (e.g. `http_x_gamecd`) contain underscores, which
+[shouldn't be in the header field](https://tools.ietf.org/html/rfc7230#section-3.2.6).
+Allowing this in NGINX is simple.
 
 	underscores_in_headers on;
 	proxy_pass_request_headers on;
 
-Because we have enabled insecure SSL settings on NGINX, you probably don't want
-to use it for any mission-critical web applications. If you continue having
-issues with NDS connectivity, please contact me.
+Working around this in Apache is a bit more difficult. For information about
+working around invalid headers in Apache, see
+[this example](http://httpd.apache.org/docs/trunk/env.html#fixheader). If you
+continue having issues with NDS connectivity, please contact me.
 
 ### Having fun
 
@@ -87,11 +96,24 @@ without ROM patches!
 
 ### Update
 
-After receiving some e-mails, I have learned that the NDS-supported ciphers have
-been disabled in OpenSSL versions past 1.0.2g, unless configured with
-"enable-weak-ssl-ciphers". This means that you may have to re-build NGINX (or
-mod_ssl for Apache) to get it working.
+Modern versions of OpenSSL have SSLv3 and the RC4 ciphers disabled by default,
+which means that you will need to compile OpenSSL yourself. For information on
+doing this, see the
+[INSTALL.md](https://github.com/openssl/openssl/blob/master/INSTALL.md)
+from the OpenSSL repository, or the
+[Compilation and Installation](https://wiki.openssl.org/index.php/Compilation_and_Installation)
+page from their wiki.
 
-If you have the means, I suggest taking Wireshark captures to find the cause of
-any SSL issues. Enabling debug logging in NGINX can also help you pinpoint
-handshake errors. If all else fails, you can find my e-mail on the about page.
+When configuring OpenSSL, be sure to specify the "enable-ssl3",
+"enable-ssl3-method" and "enable-weak-ciphers" flags like so:
+
+	./config enable-ssl3 enable-ssl3-method enable-weak-ciphers
+
+It will install in /usr/local and /usr/local/ssl by default, so it shouldn't
+interfere with the version currently installed on your system.
+
+Gentoo users can add the "sslv3" and "weak-ciphers" USE flags to OpenSSL
+and rebuild it. Since there is no weak-ciphers USE flag at the time of writing,
+you might want to add my
+[flewkey-overlay](https://git.sdf.org/flewkey/flewkey-overlay) and unmask
+`dev-libs/openssl::flewkey-overlay`.