Re: Multiple DNS Names in Subject Alt Name?

This is a multi-part message in MIME format.
--===============2948102618846519197==
Content-Type: multipart/alternative;
 boundary="------------C1402DA8DE29C77FF76F4AB0"
Content-Language: en-US

This is a multi-part message in MIME format.
--------------C1402DA8DE29C77FF76F4AB0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: quoted-printable
X-MIME-Autoconverted: from 8bit to quoted-printable by mail145c7.megamailservers.com id w1QHih9l032052

On 02/26/18 08:29, Peter Gutmann wrote:
> Stephen Hurd <[email protected]> writes:
>
>> I've disabled the check in addAttribute() (in ext_add.c)  which disall=
ows
>> adding blobs, and I'm just constructing the DER encoding myself and th=
en
>> adding it using cryptAddCertExtension().  This works, but it would be =
nice to
>> have a correct way to do this.
> That's probably the best way to do it for the time being.

The only other issues I had were getting the public key (e and n) out=20
for the JWS signing stuff (I export a self-signed cert, then parse the=20
DER encoding), and their certificate chain format... it's actually a=20
series of certificates.=C2=A0 I didn't see a way of constructing a=20
certificate chain from discrete certificates, so I decode the base64 and=20
slap a PKCS#7 wrapper around them before calling cryptCertImport().=C2=A0=
 It=20
would be nice if cryptImportCert() could handle it natively.

Regarding the certificate chain, the specification=20
(https://tools.ietf.org/html/draft-ietf-acme-acme-09#page-58) says this:

    File contains one or more certificates encoded with the PEM textual
    encoding, according toRFC 7468 <https://tools.ietf.org/html/rfc7468> =
 [RFC7468 <https://tools.ietf.org/html/rfc7468>].  In order to provide ea=
sy
    interoperation with TLS, the first certificate MUST be an end-entity
    certificate.  Each following certificate SHOULD directly certify one
    preceding it.  Because certificate validation requires that trust
    anchors be distributed independently, a certificate that specifies a
    trust anchor MAY be omitted from the chain, provided that supported
    peers are known to possess any omitted certificates.

And an example looks like this:

-----BEGIN CERTIFICATE-----
MIIFGDCCBACgAwIBAgITAPr0FKjY8OC5Kkeg885AbIfcOzANBgkqhkiG9w0BAQsF
ADAiMSAwHgYDVQQDDBdGYWtlIExFIEludGVybWVkaWF0ZSBYMTAeFw0xODAyMjYw
NDUwMDlaFw0xODA1MjcwNDUwMDlaMBoxGDAWBgNVBAMTD25peC5zeW5jaHJvLm5l
dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKw1988Kelpll9uytP9M
mGB0DKJL8uSbsuT8Jx/UrcAqOUKpEmok11bp/QCF48Ff/Ou6GjQw5qcqQI/PyOad
B7J4Ep++seINF2NN8S4FticTjeA0382LBVzLe1SiME8D7kEmPKzNtGc0PXaWxWpX
fQQiLATLogWF0bcOrNvn79av++fn3m5folwy6Uud+7Z6XSw7VxtuoBqyaGOcoB5V
tOka3tex/F4UjLSGm9LGMPo19gvY7xOiTvzh9zG16DiY1g0brkO5Z+9ovAIyB6l9
1KkvkAby7MH/O7SbeqNSuCzkiwIXW75jARVYw9PCrD+AtX2guWsmllg3GAcAngKd
o4kCAwEAAaOCAk0wggJJMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEF
BQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQU0pzHY4VHT3MF
r91xP0/jB+3DD88wHwYDVR0jBBgwFoAUwMwDRrlYIMxccnDz4S7LIKb1aDowdwYI
KwYBBQUHAQEEazBpMDIGCCsGAQUFBzABhiZodHRwOi8vb2NzcC5zdGctaW50LXgx
LmxldHNlbmNyeXB0Lm9yZzAzBggrBgEFBQcwAoYnaHR0cDovL2NlcnQuc3RnLWlu
dC14MS5sZXRzZW5jcnlwdC5vcmcvMFAGA1UdEQRJMEeCEmdhbGxlcnkuYmJzZGV2
Lm5ldIIPaG9tZS5iYnNkZXYubmV0gg9uaXguc3luY2hyby5uZXSCD3BpY3MuYmJz
ZGV2Lm5ldDCB/gYDVR0gBIH2MIHzMAgGBmeBDAECATCB5gYLKwYBBAGC3xMBAQEw
gdYwJgYIKwYBBQUHAgEWGmh0dHA6Ly9jcHMubGV0c2VuY3J5cHQub3JnMIGrBggr
BgEFBQcCAjCBngyBm1RoaXMgQ2VydGlmaWNhdGUgbWF5IG9ubHkgYmUgcmVsaWVk
IHVwb24gYnkgUmVseWluZyBQYXJ0aWVzIGFuZCBvbmx5IGluIGFjY29yZGFuY2Ug
d2l0aCB0aGUgQ2VydGlmaWNhdGUgUG9saWN5IGZvdW5kIGF0IGh0dHBzOi8vbGV0
c2VuY3J5cHQub3JnL3JlcG9zaXRvcnkvMA0GCSqGSIb3DQEBCwUAA4IBAQDr1rOa
zGglZTo9nRigvKkPdNle16zCrD99VDSEmV1PMWgmb6VOxlJSblBQV+F9LkajeNOa
0MJ7gdyfoOnED0ygg7aSb9D9KxJtZ8bPzhuXzXqc9DS3Mgu6vzdLjXXXVfp5XFRn
26NeTVrPJ/+NSMi+tEKr7nov+P8xAjCI1B5VmwpVubMtOt/9ePUk/b+nXAYHt4lr
UEWH38Fp/fk+YO4sOcdG1It+YZ6to+8hESGUWdr/cBUYdOHrLrkrAE3+V8QOZa6I
RPSQABlI7GHxbC/r17KXnLZatQToWcGTzsr/fvbJuTtioTuIBx4BF158kJvNndZE
l8BxqQh5psteqkoJ
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
MIIEqzCCApOgAwIBAgIRAIvhKg5ZRO08VGQx8JdhT+UwDQYJKoZIhvcNAQELBQAw
GjEYMBYGA1UEAwwPRmFrZSBMRSBSb290IFgxMB4XDTE2MDUyMzIyMDc1OVoXDTM2
MDUyMzIyMDc1OVowIjEgMB4GA1UEAwwXRmFrZSBMRSBJbnRlcm1lZGlhdGUgWDEw
ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDtWKySDn7rWZc5ggjz3ZB0
8jO4xti3uzINfD5sQ7Lj7hzetUT+wQob+iXSZkhnvx+IvdbXF5/yt8aWPpUKnPym
oLxsYiI5gQBLxNDzIec0OIaflWqAr29m7J8+NNtApEN8nZFnf3bhehZW7AxmS1m0
ZnSsdHw0Fw+bgixPg2MQ9k9oefFeqa+7Kqdlz5bbrUYV2volxhDFtnI4Mh8BiWCN
xDH1Hizq+GKCcHsinDZWurCqder/afJBnQs+SBSL6MVApHt+d35zjBD92fO2Je56
dhMfzCgOKXeJ340WhW3TjD1zqLZXeaCyUNRnfOmWZV8nEhtHOFbUCU7r/KkjMZO9
AgMBAAGjgeMwgeAwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAw
HQYDVR0OBBYEFMDMA0a5WCDMXHJw8+EuyyCm9Wg6MHoGCCsGAQUFBwEBBG4wbDA0
BggrBgEFBQcwAYYoaHR0cDovL29jc3Auc3RnLXJvb3QteDEubGV0c2VuY3J5cHQu
b3JnLzA0BggrBgEFBQcwAoYoaHR0cDovL2NlcnQuc3RnLXJvb3QteDEubGV0c2Vu
Y3J5cHQub3JnLzAfBgNVHSMEGDAWgBTBJnSkikSg5vogKNhcI5pFiBh54DANBgkq
hkiG9w0BAQsFAAOCAgEABYSu4Il+fI0MYU42OTmEj+1HqQ5DvyAeyCA6sGuZdwjF
UGeVOv3NnLyfofuUOjEbY5irFCDtnv+0ckukUZN9lz4Q2YjWGUpW4TTu3ieTsaC9
AFvCSgNHJyWSVtWvB5XDxsqawl1KzHzzwr132bF2rtGtazSqVqK9E07sGHMCf+zp
DQVDVVGtqZPHwX3KqUtefE621b8RI6VCl4oD30Olf8pjuzG4JKBFRFclzLRjo/h7
IkkfjZ8wDa7faOjVXx6n+eUQ29cIMCzr8/rNWHS9pYGGQKJiY2xmVC9h12H99Xyf
zWE9vb5zKP3MVG6neX1hSdo7PEAb9fqRhHkqVsqUvJlIRmvXvVKTwNCP3eCjRCCI
PTAvjV+4ni786iXwwFYNz8l3PmPLCyQXWGohnJ8iBm+5nk7O2ynaPVW0U2W+pt2w
SVuvdDM5zGv2f9ltNWUiYZHJ1mmO97jSY/6YfdOUH66iRtQtDkHBRdkNBsMbD+Em
2TgBldtHNSJBfB3pm9FblgOcJ0FSWcUDWJ7vO0+NTXlgrRofRT6pVywzxVo6dND0
WzYlTWeUVsO40xJqhgUQRER9YLOLxJ0O6C8i0xFxAMKOtSdodMB3RIwt7RFQ0uyt
n5Z5MqkYhlMI3J1tPRTp1nEt9fyGspBOO05gi148Qasp+3N+svqKomoQglNoAxU=3D
-----END CERTIFICATE-----


--------------C1402DA8DE29C77FF76F4AB0
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-MIME-Autoconverted: from 8bit to quoted-printable by mail145c7.megamailservers.com id w1QHih9l032052

<html>
  <head>
    <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dutf=
-8">
  </head>
  <body text=3D"#000000" bgcolor=3D"#FFFFFF">
    <div class=3D"moz-cite-prefix">On 02/26/18 08:29, Peter Gutmann wrote=
:<br>
    </div>
    <blockquote type=3D"cite"
      cite=3D"mid:[email protected]">
      <pre wrap=3D"">Stephen Hurd <a class=3D"moz-txt-link-rfc2396E" href=
=3D"mailto:[email protected]">&lt;[email protected]&gt;</a> writes:

</pre>
      <blockquote type=3D"cite">
        <pre wrap=3D"">I've disabled the check in addAttribute() (in ext_=
add.c)  which disallows
adding blobs, and I'm just constructing the DER encoding myself and then
adding it using cryptAddCertExtension().  This works, but it would be nic=
e to
have a correct way to do this.
</pre>
      </blockquote>
      <pre wrap=3D"">
That's probably the best way to do it for the time being.</pre>
    </blockquote>
    <br>
    The only other issues I had were getting the public key (e and n)
    out for the JWS signing stuff (I export a self-signed cert, then
    parse the DER encoding), and their certificate chain format... it's
    actually a series of certificates.=C2=A0 I didn't see a way of
    constructing a certificate chain from discrete certificates, so I
    decode the base64 and slap a PKCS#7 wrapper around them before
    calling cryptCertImport().=C2=A0 It would be nice if cryptImportCert(=
)
    could handle it natively.<br>
    <br>
    Regarding the certificate chain, the specification
    (<a class=3D"moz-txt-link-freetext" href=3D"https://tools.ietf.org/ht=
ml/draft-ietf-acme-acme-09#page-58">https://tools.ietf.org/html/draft-iet=
f-acme-acme-09#page-58</a>) says
    this:<br>
    <br>
    <pre class=3D"newpage">   File contains one or more certificates enco=
ded with the PEM textual
   encoding, according to <a href=3D"https://tools.ietf.org/html/rfc7468"=
>RFC 7468</a> [<a href=3D"https://tools.ietf.org/html/rfc7468" title=3D"&=
quot;Textual Encodings of PKIX, PKCS, and CMS Structures&quot;">RFC7468</=
a>].  In order to provide easy
   interoperation with TLS, the first certificate MUST be an end-entity
   certificate.  Each following certificate SHOULD directly certify one
   preceding it.  Because certificate validation requires that trust
   anchors be distributed independently, a certificate that specifies a
   trust anchor MAY be omitted from the chain, provided that supported
   peers are known to possess any omitted certificates.

And an example looks like this:

-----BEGIN CERTIFICATE-----
MIIFGDCCBACgAwIBAgITAPr0FKjY8OC5Kkeg885AbIfcOzANBgkqhkiG9w0BAQsF
ADAiMSAwHgYDVQQDDBdGYWtlIExFIEludGVybWVkaWF0ZSBYMTAeFw0xODAyMjYw
NDUwMDlaFw0xODA1MjcwNDUwMDlaMBoxGDAWBgNVBAMTD25peC5zeW5jaHJvLm5l
dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKw1988Kelpll9uytP9M
mGB0DKJL8uSbsuT8Jx/UrcAqOUKpEmok11bp/QCF48Ff/Ou6GjQw5qcqQI/PyOad
B7J4Ep++seINF2NN8S4FticTjeA0382LBVzLe1SiME8D7kEmPKzNtGc0PXaWxWpX
fQQiLATLogWF0bcOrNvn79av++fn3m5folwy6Uud+7Z6XSw7VxtuoBqyaGOcoB5V
tOka3tex/F4UjLSGm9LGMPo19gvY7xOiTvzh9zG16DiY1g0brkO5Z+9ovAIyB6l9
1KkvkAby7MH/O7SbeqNSuCzkiwIXW75jARVYw9PCrD+AtX2guWsmllg3GAcAngKd
o4kCAwEAAaOCAk0wggJJMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEF
BQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQU0pzHY4VHT3MF
r91xP0/jB+3DD88wHwYDVR0jBBgwFoAUwMwDRrlYIMxccnDz4S7LIKb1aDowdwYI
KwYBBQUHAQEEazBpMDIGCCsGAQUFBzABhiZodHRwOi8vb2NzcC5zdGctaW50LXgx
LmxldHNlbmNyeXB0Lm9yZzAzBggrBgEFBQcwAoYnaHR0cDovL2NlcnQuc3RnLWlu
dC14MS5sZXRzZW5jcnlwdC5vcmcvMFAGA1UdEQRJMEeCEmdhbGxlcnkuYmJzZGV2
Lm5ldIIPaG9tZS5iYnNkZXYubmV0gg9uaXguc3luY2hyby5uZXSCD3BpY3MuYmJz
ZGV2Lm5ldDCB/gYDVR0gBIH2MIHzMAgGBmeBDAECATCB5gYLKwYBBAGC3xMBAQEw
gdYwJgYIKwYBBQUHAgEWGmh0dHA6Ly9jcHMubGV0c2VuY3J5cHQub3JnMIGrBggr
BgEFBQcCAjCBngyBm1RoaXMgQ2VydGlmaWNhdGUgbWF5IG9ubHkgYmUgcmVsaWVk
IHVwb24gYnkgUmVseWluZyBQYXJ0aWVzIGFuZCBvbmx5IGluIGFjY29yZGFuY2Ug
d2l0aCB0aGUgQ2VydGlmaWNhdGUgUG9saWN5IGZvdW5kIGF0IGh0dHBzOi8vbGV0
c2VuY3J5cHQub3JnL3JlcG9zaXRvcnkvMA0GCSqGSIb3DQEBCwUAA4IBAQDr1rOa
zGglZTo9nRigvKkPdNle16zCrD99VDSEmV1PMWgmb6VOxlJSblBQV+F9LkajeNOa
0MJ7gdyfoOnED0ygg7aSb9D9KxJtZ8bPzhuXzXqc9DS3Mgu6vzdLjXXXVfp5XFRn
26NeTVrPJ/+NSMi+tEKr7nov+P8xAjCI1B5VmwpVubMtOt/9ePUk/b+nXAYHt4lr
UEWH38Fp/fk+YO4sOcdG1It+YZ6to+8hESGUWdr/cBUYdOHrLrkrAE3+V8QOZa6I
RPSQABlI7GHxbC/r17KXnLZatQToWcGTzsr/fvbJuTtioTuIBx4BF158kJvNndZE
l8BxqQh5psteqkoJ
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
MIIEqzCCApOgAwIBAgIRAIvhKg5ZRO08VGQx8JdhT+UwDQYJKoZIhvcNAQELBQAw
GjEYMBYGA1UEAwwPRmFrZSBMRSBSb290IFgxMB4XDTE2MDUyMzIyMDc1OVoXDTM2
MDUyMzIyMDc1OVowIjEgMB4GA1UEAwwXRmFrZSBMRSBJbnRlcm1lZGlhdGUgWDEw
ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDtWKySDn7rWZc5ggjz3ZB0
8jO4xti3uzINfD5sQ7Lj7hzetUT+wQob+iXSZkhnvx+IvdbXF5/yt8aWPpUKnPym
oLxsYiI5gQBLxNDzIec0OIaflWqAr29m7J8+NNtApEN8nZFnf3bhehZW7AxmS1m0
ZnSsdHw0Fw+bgixPg2MQ9k9oefFeqa+7Kqdlz5bbrUYV2volxhDFtnI4Mh8BiWCN
xDH1Hizq+GKCcHsinDZWurCqder/afJBnQs+SBSL6MVApHt+d35zjBD92fO2Je56
dhMfzCgOKXeJ340WhW3TjD1zqLZXeaCyUNRnfOmWZV8nEhtHOFbUCU7r/KkjMZO9
AgMBAAGjgeMwgeAwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAw
HQYDVR0OBBYEFMDMA0a5WCDMXHJw8+EuyyCm9Wg6MHoGCCsGAQUFBwEBBG4wbDA0
BggrBgEFBQcwAYYoaHR0cDovL29jc3Auc3RnLXJvb3QteDEubGV0c2VuY3J5cHQu
b3JnLzA0BggrBgEFBQcwAoYoaHR0cDovL2NlcnQuc3RnLXJvb3QteDEubGV0c2Vu
Y3J5cHQub3JnLzAfBgNVHSMEGDAWgBTBJnSkikSg5vogKNhcI5pFiBh54DANBgkq
hkiG9w0BAQsFAAOCAgEABYSu4Il+fI0MYU42OTmEj+1HqQ5DvyAeyCA6sGuZdwjF
UGeVOv3NnLyfofuUOjEbY5irFCDtnv+0ckukUZN9lz4Q2YjWGUpW4TTu3ieTsaC9
AFvCSgNHJyWSVtWvB5XDxsqawl1KzHzzwr132bF2rtGtazSqVqK9E07sGHMCf+zp
DQVDVVGtqZPHwX3KqUtefE621b8RI6VCl4oD30Olf8pjuzG4JKBFRFclzLRjo/h7
IkkfjZ8wDa7faOjVXx6n+eUQ29cIMCzr8/rNWHS9pYGGQKJiY2xmVC9h12H99Xyf
zWE9vb5zKP3MVG6neX1hSdo7PEAb9fqRhHkqVsqUvJlIRmvXvVKTwNCP3eCjRCCI
PTAvjV+4ni786iXwwFYNz8l3PmPLCyQXWGohnJ8iBm+5nk7O2ynaPVW0U2W+pt2w
SVuvdDM5zGv2f9ltNWUiYZHJ1mmO97jSY/6YfdOUH66iRtQtDkHBRdkNBsMbD+Em
2TgBldtHNSJBfB3pm9FblgOcJ0FSWcUDWJ7vO0+NTXlgrRofRT6pVywzxVo6dND0
WzYlTWeUVsO40xJqhgUQRER9YLOLxJ0O6C8i0xFxAMKOtSdodMB3RIwt7RFQ0uyt
n5Z5MqkYhlMI3J1tPRTp1nEt9fyGspBOO05gi148Qasp+3N+svqKomoQglNoAxU=3D
-----END CERTIFICATE-----

</pre>
  </body>
</html>

--------------C1402DA8DE29C77FF76F4AB0--


--===============2948102618846519197==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KQ3J5cHRsaWIg
bWFpbGluZyBsaXN0CkNyeXB0bGliQG1ic2tzLmZyYW5rZW4uZGVBZG1pbmlzdHJhdGlvbiB2aWEg
TWFpbDogY3J5cHRsaWItcmVxdWVzdEBtYnNrcy5mcmFua2VuLmRlCkFyY2hpdmU6IGZ0cDovL2Z0
cC5mcmFua2VuLmRlL3B1Yi9jcnlwdC9jcnlwdGxpYi9hcmNoaXZlcy8KaHR0cDovL25ld3MuZ21h
bmUub3JnL2dtYW5lLmNvbXAuZW5jcnlwdGlvbi5jcnlwdGxpYgpQb3N0cyBmcm9tIG5vbi1zdWJz
Y3JpYmVkIGFkZHJlc3NlcyBhcmUgYmxvY2tlZCB0byBwcmV2ZW50IHNwYW0sIHBsZWFzZQpzdWJz
Y3JpYmUgaW4gb3JkZXIgdG8gcG9zdCBtZXNzYWdlcy4K

--===============2948102618846519197==--