x509-cert: Error decoding CSR signature bytes #1041
Comments
|
The discrepancy seems to be a fixed-width non-ASN.1 signature ( Can you provide a code example? I think you just need to switch the signature type. Also perhaps it's possible we impl'd the relevant traits incorrectly. I would hope this would be a compile error rather than generating an invalid certificate. |
|
Yes, sorry, should have included that initially... use p256::{
ecdsa::{Signature, SigningKey},
pkcs8::{LineEnding, ObjectIdentifier},
};
use rand_core::OsRng;
use std::error::Error;
use std::str::FromStr;
use x509_cert::{
attr::Attribute,
builder::{Builder, RequestBuilder},
der::{self, asn1, EncodePem},
name::Name,
};
fn main() -> Result<(), Box<dyn Error>> {
let signing_key = SigningKey::random(&mut OsRng);
let subject = Name::from_str("CN=Test CN,OU=Test OU,O=Test O,C=US,UID=test123")?;
let builder = RequestBuilder::new(subject, &signing_key)?;
let mut cert_req = builder.build::<Signature>()?;
let mut values = asn1::SetOfVec::new();
values.add(asn1::Any::new(
der::Tag::PrintableString,
"password123".as_bytes(),
)?)?;
let mut attributes = asn1::SetOfVec::new();
attributes.add(Attribute {
oid: ObjectIdentifier::new_unwrap("1.2.840.113549.1.9.7"),
values,
})?;
cert_req.info.attributes = attributes;
let cert_req_pem = cert_req.to_pem(LineEnding::LF)?;
println!("{}", cert_req_pem);
Ok(())
}Are you saying I just need to change that That gives me this CSR: The signature seems to be a tad longer now. My CA/RA isn't giving the same "error decoding signature bytes", but it's still not liking it. Thanks for your quick response! |
Yeah, it's reproducible here. I'll have a look. |
|
alright, so this will produce a correctly signed CSR: use p256::{
ecdsa::{DerSignature, SigningKey},
pkcs8::{LineEnding, ObjectIdentifier},
};
use rand_core::OsRng;
use std::error::Error;
use std::str::FromStr;
use x509_cert::{
attr::Attribute,
builder::{Builder, RequestBuilder},
der::{self, asn1, EncodePem},
name::Name,
};
fn main() -> Result<(), Box<dyn Error>> {
let signing_key = SigningKey::random(&mut OsRng);
let subject = Name::from_str("CN=Test CN,OU=Test OU,O=Test O,C=US,UID=test123")?;
let builder = RequestBuilder::new(subject, &signing_key)?;
let mut cert_req = builder.build::<DerSignature>()?;
//let mut values = asn1::SetOfVec::new();
//values.add(asn1::Any::new(
// der::Tag::PrintableString,
// "password123".as_bytes(),
//)?)?;
//let mut attributes = asn1::SetOfVec::new();
//attributes.add(Attribute {
// oid: ObjectIdentifier::new_unwrap("1.2.840.113549.1.9.7"),
// values,
//})?;
//cert_req.info.attributes = attributes;
let cert_req_pem = cert_req.to_pem(LineEnding::LF)?;
println!("{}", cert_req_pem);
Ok(())
}The reason it still fails with If you want to add the password extension, you'll have to use the I fixed the examples in #1043 |
Disregard that, this is not an x509v3 extension, we'll have to come up with something. |
|
Ah, yeah, looking at the attributes you commented-out, that makes sense now. Thanks for taking a look! Does it make sense to allow them to be passed into |
|
yeah, an I don't have time to do that right now, but I'd be happy to take a look in a couple weeks. |
|
@baloo you can build an intermediate Using this |
|
oh nice, I missed that! |
|
@jstayton I just pushed a |
|
Everything still works on my end with |
|
@jstayton that particular change should make using |
|
Hey @baloo – Sorry for the delay in getting back to you. I just gave it a try and it worked great! Thanks for following through with that. I'd be grateful for a new release with that when you get a chance. Thanks! |
|
Awesome! Thank you. I guess I could proceed with a 0.2.3 release, there are a couple pending fixup commits. Is there anything missing in that issue btw? Or can I close it? |
|
👍🏻 I think that's it here. |
Hey 👋🏻
I'm using the new
RequestBuilderfrom #1034 (/cc @baloo), and when I submit the CSR to my CA/RA, it says "error decoding signature bytes".Here's the CSR:
For comparison, here's the exact same CSR generated by another package/language, which my CA/RA accepts just fine:
The only thing noticeably different is that the second signature is a bit longer.
Any help is appreciated! Thanks.
The text was updated successfully, but these errors were encountered: