RE: Prime239v1 self-signed certificate cannot be verified
Eric Tournier <[email protected]> Fri, 13 Dec 2019 08:47:17 +0000
| Newsgroups | gmane.comp.encryption.bouncy-castle.devel |
|---|---|
| Message-ID | <[email protected]> |
--_000_8e3f1aba6f19405ea5b388b0fd6046a9SRVMAILkeynectissalocal_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi everybody Thanks for the answer, David In fact OpenSSL is the only one which seems to verify the certificate wit= hout throwing an error, with the following: #openssl verify -CAfile prime239v1.cer prime239v1.cer As I'm not an OpenSSL guru, I don't know if it is lying or not. In fact b= oth BC and SUN say that they cannot verify my self-signed certificate with = its own public key I'll try to sign something with the private key (which is in our HSM) and= then verifying it. Then I go back here with the results =C9ric De : David Hook [mailto:dgh-rTAZ0PM/[email protected]] Envoy=E9 : jeudi 12 d=E9cembre 2019 01:56 =C0 : [email protected] Objet : Re: [dev-crypto] Prime239v1 self-signed certificate cannot be verif= ied It looks alright to me as well. How are you verifying it in openSSL though?= I've played around with the openssl verify command and it seems I can get = it to print OK in a number of situations where I would not have expected it= . Something clearly is not right here. Have you tried using java to sign a = short message and then verify it? That would at least tell us if it's the s= ignature or the certificate encoding that is the issue. Regards, David --_000_8e3f1aba6f19405ea5b388b0fd6046a9SRVMAILkeynectissalocal_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr= osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:= //www.w3.org/TR/REC-html40"> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-= 1"> <meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)"> <style><!-- /* Font Definitions */ @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0cm; margin-bottom:.0001pt; font-size:11.0pt; font-family:"Calibri",sans-serif; color:black; mso-fareast-language:EN-US;} a:link, span.MsoHyperlink {mso-style-priority:99; color:#0563C1; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {mso-style-priority:99; color:#954F72; text-decoration:underline;} p.MsoPlainText, li.MsoPlainText, div.MsoPlainText {mso-style-priority:99; mso-style-link:"Texte brut Car"; margin:0cm; margin-bottom:.0001pt; font-size:11.0pt; font-family:"Calibri",sans-serif; color:black;} p {mso-style-priority:99; mso-margin-top-alt:auto; margin-right:0cm; mso-margin-bottom-alt:auto; margin-left:0cm; font-size:12.0pt; font-family:"Times New Roman",serif; color:black;} span.TextebrutCar {mso-style-name:"Texte brut Car"; mso-style-priority:99; mso-style-link:"Texte brut"; font-family:"Calibri",sans-serif; mso-fareast-language:FR;} span.EmailStyle19 {mso-style-type:personal; font-family:"Calibri",sans-serif; color:windowtext;} span.EmailStyle21 {mso-style-type:personal-reply; font-family:"Calibri",sans-serif; color:#1F497D;} .MsoChpDefault {mso-style-type:export-only; font-size:10.0pt;} @page WordSection1 {size:612.0pt 792.0pt; margin:70.85pt 70.85pt 70.85pt 70.85pt;} div.WordSection1 {page:WordSection1;} --></style><!--[if gte mso 9]><xml> <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext=3D"edit"> <o:idmap v:ext=3D"edit" data=3D"1" /> </o:shapelayout></xml><![endif]--> </head> <body bgcolor=3D"white" lang=3D"FR" link=3D"#0563C1" vlink=3D"#954F72"> <div class=3D"WordSection1"> <p class=3D"MsoNormal"><span style=3D"color:#1F497D">Hi everybody<o:p></o:p= ></span></p> <p class=3D"MsoNormal"><span style=3D"color:#1F497D"><o:p> </o:p></spa= n></p> <p class=3D"MsoNormal"><span style=3D"color:#1F497D"> Thanks for the = answer, David<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"> = In fact OpenSSL is the only one which seems to verify the certificate witho= ut throwing an error, with the following: <o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Courier New",serif;color:#1F497D">#openssl verify -CAfile= prime239v1.cer prime239v1.cer</span><span lang=3D"EN-US" style=3D"font-fam= ily:"Courier New",serif;color:#1F497D"><o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"> = As I’m not an OpenSSL guru, I don’t know if it is lying or not.= In fact both BC and SUN say that they cannot verify my self-signed certifi= cate with its own public key<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"><o:p>&n= bsp;</o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"> = I’ll try to sign something with the private key (which is in our HSM)= and then verifying it. Then I go back here with the results<o:p></o:p></sp= an></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"><o:p>&n= bsp;</o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D">=C9ric<= o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:#1F497D"><o:p>&n= bsp;</o:p></span></p> <div> <div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm = 0cm 0cm"> <p class=3D"MsoNormal"><b><span style=3D"color:windowtext;mso-fareast-langu= age:FR">De :</span></b><span style=3D"color:windowtext;mso-fareast-lan= guage:FR"> David Hook [mailto:dgh-rTAZ0PM/[email protected]] <br> <b>Envoy=E9 :</b> jeudi 12 d=E9cembre 2019 01:56<br> <b>=C0 :</b> [email protected]<br> <b>Objet :</b> Re: [dev-crypto] Prime239v1 self-signed certificate can= not be verified<o:p></o:p></span></p> </div> </div> <p class=3D"MsoNormal"><o:p> </o:p></p> <div> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;mso-fareast-language= :FR"><o:p> </o:p></span></p> </div> <div> <p class=3D"MsoNormal">It looks alright to me as well. How are you verifyin= g it in openSSL though? I've played around with the openssl verify command = and it seems I can get it to print OK in a number of situations where I wou= ld not have expected it. Something clearly is not right here. Have you tried using java to sign a short messa= ge and then verify it? That would at least tell us if it's the signature or= the certificate encoding that is the issue.<o:p></o:p></p> </div> <div> <p class=3D"MsoNormal"><o:p> </o:p></p> </div> <div> <p class=3D"MsoNormal">Regards,<o:p></o:p></p> </div> <div> <p class=3D"MsoNormal"><o:p> </o:p></p> </div> <div> <p class=3D"MsoNormal">David<o:p></o:p></p> </div> <div> <p class=3D"MsoNormal"><o:p> </o:p></p> </div> <p><o:p> </o:p></p> </div> </body> </html> --_000_8e3f1aba6f19405ea5b388b0fd6046a9SRVMAILkeynectissalocal_--