Re: Cyrus IMAP + Client certificate authentication
Johannes Eckhardt <[email protected]> Thu, 3 Aug 2023 17:35:42 +0200
| Newsgroups | gmane.comp.security.cyrus.sasl |
|---|---|
| Organization | Institut für Höhere Studien - Institute fo r Advanced Studies (IHS) |
| Message-ID | <[email protected]> |
------------=_1691077010-724225-0
Content-Language: en-US
Content-Type: multipart/signed;
boundary=------------ms020707080607020403080104; micalg=sha-256;
protocol="application/pkcs7-signature"
Content-Transfer-Encoding: 7bit
--------------ms020707080607020403080104
Content-Type: multipart/alternative;
boundary=------------oXmd7VtpWdyrA0hjOBR7NBpm
Content-Transfer-Encoding: 7bit
--------------oXmd7VtpWdyrA0hjOBR7NBpm
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
On 03.08.2023 14:37, Ken Hornstein via SASL wrote:
> As part of the TLS negotiation the TLS server tells the client, "here's
> a list of CA's I will accept client certificates for". So the first
> question I would ask is, "Is Cyrus sending a list of CAs?" You can check
> this with the openssl command line utility "s_client". E.g.:
>
> % openssl s_client -starttls imap -connect imap-server:143
>
> You'll see a bunch of stuff printed out. What you WANT to see is:
>
> Acceptable client certificate CA names
> /C=CA-name/CN=your CA 1
> /C=CA-name/CN=your CA 2
> [...]
I can see that list - so that part should be ok.
> The list of CAs sent I _believe_ is controlled by the config file
> entry "tls_client_ca_file" (you should also probably set tls_client_ca_dir
> pointing to a hashed directory containing the complete certificate
> bundle for your PKI). Also note the "tls_client_certs" entry which controls
> whether or not a client certificate is optional, required, or disabled.
> I also remember seeing that if you crank up logging on the IMAP server
> it should log the certificate commonName if one was presented.
>
> I see that openssl s_client also supports sending a client certificate
> so you could test things out that way (I don't know if you're using
> a smartcard or not, it looks like only newer openssls support that and
> getting a smartcard working with openssl is a pain).
I'm using a "normal" certificate - no smartcard. Trying to authenticate
using openssl is a good advise. The next few days I won't have much time
to spent on that but I'll get back to you next week.
Best,
Johannes
--------------oXmd7VtpWdyrA0hjOBR7NBpm
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 03.08.2023 14:37, Ken Hornstein via
SASL wrote:<br>
</div>
<blockquote type="cite"
cite="mid:[email protected]"><span
style="white-space: pre-wrap">
</span>
<pre class="moz-quote-pre" wrap="">As part of the TLS negotiation the TLS server tells the client, "here's
a list of CA's I will accept client certificates for". So the first
question I would ask is, "Is Cyrus sending a list of CAs?" You can check
this with the openssl command line utility "s_client". E.g.:
% openssl s_client -starttls imap -connect imap-server:143
You'll see a bunch of stuff printed out. What you WANT to see is:
Acceptable client certificate CA names
/C=CA-name/CN=your CA 1
/C=CA-name/CN=your CA 2
[...]
</pre>
</blockquote>
<p>I can see that list - so that part should be ok.</p>
<blockquote type="cite"
cite="mid:[email protected]">
<pre class="moz-quote-pre" wrap="">The list of CAs sent I _believe_ is controlled by the config file
entry "tls_client_ca_file" (you should also probably set tls_client_ca_dir
pointing to a hashed directory containing the complete certificate
bundle for your PKI). Also note the "tls_client_certs" entry which controls
whether or not a client certificate is optional, required, or disabled.
I also remember seeing that if you crank up logging on the IMAP server
it should log the certificate commonName if one was presented.
I see that openssl s_client also supports sending a client certificate
so you could test things out that way (I don't know if you're using
a smartcard or not, it looks like only newer openssls support that and
getting a smartcard working with openssl is a pain).</pre>
</blockquote>
<p>I'm using a "normal" certificate - no smartcard. Trying to
authenticate using openssl is a good advise. The next few days I
won't have much time to spent on that but I'll get back to you
next week.</p>
<p>Best,</p>
<p>Johannes<br>
</p>
</body>
</html>
--------------oXmd7VtpWdyrA0hjOBR7NBpm--
--------------ms020707080607020403080104
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature
MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG
9w0BBwEAAKCCDXowggaMMIIEdKADAgECAhEAsIjdKBiFqVQIGBUCMN0JijAN
BgkqhkiG9w0BAQwFADBGMQswCQYDVQQGEwJOTDEZMBcGA1UEChMQR0VBTlQg
VmVyZW5pZ2luZzEcMBoGA1UEAxMTR0VBTlQgUGVyc29uYWwgQ0EgNDAeFw0y
MTExMDgwMDAwMDBaFw0yNDExMDcyMzU5NTlaMIHpMQ0wCwYDVQQREwQxMDgw
MUswSQYDVQQKDEJJbnN0aXR1dCBmw7xyIEjDtmhlcmUgU3R1ZGllbi1JbnN0
aXR1dGUgZm9yIEFkdmFuY2VkIFN0dWRpZXMgKElIUykxITAfBgNVBAkMGEpv
c2Vmc3TDpGR0ZXIgU3RyYcOfZSAzOTENMAsGA1UECBMEV2llbjENMAsGA1UE
BxMEV2llbjELMAkGA1UEBhMCQVQxGjAYBgNVBAMTEUpvaGFubmVzIEVja2hh
cmR0MSEwHwYJKoZIhvcNAQkBFhJqb2hhbm5lc0BpaHMuYWMuYXQwggEiMA0G
CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHUC7R/i9ODG+skdq8TAU3hqnc
wBtHDO6rTJFunDbSvyk3jYJiZ76wEf+fKHbR+oCDI5Sd8KqykQ1HyWwUUl8r
65NlCo6Iw8WLauUnlFLH4WNys4lTSHud0uXdd4ey0/NJAhgWr/qZlrzS2L+U
BA8+vz31CB0WEw4zQWwVMovPdd9M5fNtTYhVtOv9bra/LaeNaAKrFuRbtnGY
pGiLJwuyvNhX37QQdzJTNtaOB5TP0Gona0HqI37oKVesd2B/EVA113Elnf+v
yCKA5HKMUpeD5nDsfG+ayXEh9PEYbrg96UMCUmlIaqbiNNVOFqsNhJHQKyjk
hPIE7bIUKu7r87Y1AgMBAAGjggHPMIIByzAfBgNVHSMEGDAWgBRpAKHHIVj4
4MUbILAK3adRvxPZ5DAdBgNVHQ4EFgQUyJoz+WNI7uAeTqJ0j6hCWrMbYpIw
DgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYB
BQUHAwQGCCsGAQUFBwMCMD8GA1UdIAQ4MDYwNAYLKwYBBAGyMQECAk8wJTAj
BggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwQgYDVR0fBDsw
OTA3oDWgM4YxaHR0cDovL0dFQU5ULmNybC5zZWN0aWdvLmNvbS9HRUFOVFBl
cnNvbmFsQ0E0LmNybDB4BggrBgEFBQcBAQRsMGowPQYIKwYBBQUHMAKGMWh0
dHA6Ly9HRUFOVC5jcnQuc2VjdGlnby5jb20vR0VBTlRQZXJzb25hbENBNC5j
cnQwKQYIKwYBBQUHMAGGHWh0dHA6Ly9HRUFOVC5vY3NwLnNlY3RpZ28uY29t
ME0GA1UdEQRGMESBG0pvaGFubmVzLkVja2hhcmR0QGlocy5hYy5hdIERaG90
bGluZUBpaHMuYWMuYXSBEmpvaGFubmVzQGlocy5hYy5hdDANBgkqhkiG9w0B
AQwFAAOCAgEAk88tD84oCgTEVZUmI2WatrEAYK2lSl7xePrLvd+EP5ttSnRr
I/SdaMOW8QtyiQJEL0EuZ7+Ps44Ltxh99FeDFrcmqIMreH81iEBzauDapCZP
IeUEk8bRaK4qSsE+uhwfYwR0wcONpXq9kl6f1VOgYsnjsNAw7/3ohegShKyB
XijTuVC4XYNTIREXC/hmOy+ai8/SaFOIBumbIz9TZnmmgmu7w+jutmZv2ZoB
OtUdJzWL6fPXdz36FY4oNlayKY2Er+keJBsa6Lt/SUcqOEArqGaGT08n2Rdi
qyt+RVxe6CtdljcB9R1cT0/dxnlf6a8hkiZPeiW7lfJlZYLBWD8jbT35BCuL
9XEbn/pU41Q2h7+FF0n5YRqd0S6730onoVrNsCkY8xBJK95KGTuQnUwUfnp+
Ng8WdVHOa7u8OYnrWfK7wFgQ7DK+zFK7pRM+cY8Sf13IVJQ7CobRwQjyOHQd
fTwpeDr5k0mhkMiR95MbfLNI7CfG0IUiGktoJg6N/o+6bpjiJYnbTSgzmMT+
D2bOHiCLI9nDmqSovx45R/i82bhTHgkhQ6fr+INeSYI5TNuiKkcHhzaOmoD6
LzMnq1KntnVt7XQwHC/2Gem+FSCPwRi4QkCCDQSxftzygJh9772EgbQEtZD6
cn8Hcl8elJCcIOJbCsgx7rulpOKXV5xvq+8wggbmMIIEzqADAgECAhAxAnDU
Nb6bJJr4VtDh4oVJMA0GCSqGSIb3DQEBDAUAMIGIMQswCQYDVQQGEwJVUzET
MBEGA1UECBMKTmV3IEplcnNleTEUMBIGA1UEBxMLSmVyc2V5IENpdHkxHjAc
BgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEuMCwGA1UEAxMlVVNFUlRy
dXN0IFJTQSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0yMDAyMTgwMDAw
MDBaFw0zMzA1MDEyMzU5NTlaMEYxCzAJBgNVBAYTAk5MMRkwFwYDVQQKExBH
RUFOVCBWZXJlbmlnaW5nMRwwGgYDVQQDExNHRUFOVCBQZXJzb25hbCBDQSA0
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAs0riIl4nW+kEWxQE
NTIgFK600jFAxs1QwB6hRMqvnkphfy2Q3mKbM2otpELKlgE8/3AQPYBo7p7y
eORuPMnAuA+oMGRb2wbeSaLcZbpwXgfCvnKxmq97/kQkOFX706F9O7/h0yeh
HhDjUdyMyT0zMs4AMBDRrAFn/b2vR3j0BSYgoQs16oSqadM3p+d0vvH/YrRM
tOhkvGpLuzL8m+LTAQWvQJ92NwCyKiHspoP4mLPJvVpEpDMnpDbRUQdftSpZ
zVKTNORvPrGPRLnJ0EEVCHR82LL6oz915WkrgeCY9ImuulBn4uVsd9ZpubCg
M/EXvVBlViKqusChSsZEn7juIsGIiDyaIhhLsd3amm8BS3bgK6AxdSMROND6
hiHT182Lmf8C+gRHxQG9McvG35uUvRu8v7bPZiJRaT7ZC2f50P4lTlnbLvWp
Xv5yv7hheO8bMXltiyLweLB+VNvg+GnfL6TW3Aq1yF1yrZAZzR4MbpjTWdEd
SLKvz8+0wCwscQ81nbDOwDt9vyZ+0eJXbRkWZiqScnwAg5/B1NUD4TrYlrI4
n6zFp2pyYUOiuzP+as/AZnz63GvjFK69WODR2W/TK4D7VikEMhg18vhuRf4h
xnWZOy0vhfDR/g3aJbdsGac+diahjEwzyB+UKJOCyzvecG8bZ/u/U8PsEMZg
07iIPi8CAwEAAaOCAYswggGHMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvA
nfKyA2bLMB0GA1UdDgQWBBRpAKHHIVj44MUbILAK3adRvxPZ5DAOBgNVHQ8B
Af8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHSUEFjAUBggrBgEF
BQcDAgYIKwYBBQUHAwQwOAYDVR0gBDEwLzAtBgRVHSAAMCUwIwYIKwYBBQUH
AgEWF2h0dHBzOi8vc2VjdGlnby5jb20vQ1BTMFAGA1UdHwRJMEcwRaBDoEGG
P2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZp
Y2F0aW9uQXV0aG9yaXR5LmNybDB2BggrBgEFBQcBAQRqMGgwPwYIKwYBBQUH
MAKGM2h0dHA6Ly9jcnQudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FBZGRU
cnVzdENBLmNydDAlBggrBgEFBQcwAYYZaHR0cDovL29jc3AudXNlcnRydXN0
LmNvbTANBgkqhkiG9w0BAQwFAAOCAgEACgVOew2PHxM5AP1v7GLGw+3tF6rj
Acx43D9Hl110Q+BABABglkrPkES/VyMZsfuds8fcDGvGE3o5UfjSno4sij0x
dKut8zMazv8/4VMKPCA3EUS0tDUoL01ugDdqwlyXuYizeXyH2ICAQfXMtS+r
az7mf741CZvO50OxMUMxqljeRfVPDJQJNHOYi2pxuxgjKDYx4hdZ9G2o+oLl
Hhu5+anMDkE8g0tffjRKn8I1D1BmrDdWR/IdbBOj6870abYvqys1qYlPotv5
N5dm+XxQ8vlrvY7+kfQaAYeO3rP1DM8BGdpEqyFVa+I0rpJPhaZkeWW7cImD
QFerHW9bKzBrCC815a3WrEhNpxh72ZJZNs1HYJ+29NTB6uu4NJjaMxpk+g2p
uNSm4b9uVjBbPO9V6sFSG+IBqE9ckX/1XjzJtY8Grqoo4SiRb6zcHhp3mxj3
oqWi8SKNohAOKnUc7RIP6ss1hqIFyv0xXZor4N9tnzD0Fo0JDIURjDPEgo5W
Tdti/MdGTmKFQNqxyZuT9uSI2Xvhz8p+4pCYkiZqpahZlHqMFxdw9XRZQgrP
+cgtOkWEaiNkRBbvtvLdp7MCL2OsQhQEdEbUvDM9slzZXdI7NjJokVBq3O4p
ls3VD2z3L/bHVBe0rBERjyM2C/HSIh84rfmAqBgklzIOqXhd+4RzadUxggM7
MIIDNwIBATBbMEYxCzAJBgNVBAYTAk5MMRkwFwYDVQQKExBHRUFOVCBWZXJl
bmlnaW5nMRwwGgYDVQQDExNHRUFOVCBQZXJzb25hbCBDQSA0AhEAsIjdKBiF
qVQIGBUCMN0JijANBglghkgBZQMEAgEFAKCCAbEwGAYJKoZIhvcNAQkDMQsG
CSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMjMwODAzMTUzNTQzWjAvBgkq
hkiG9w0BCQQxIgQgJDPYbK4cFTwb89bh5Y2x9pqUROQhjmFZKFc0NZU8losw
agYJKwYBBAGCNxAEMV0wWzBGMQswCQYDVQQGEwJOTDEZMBcGA1UEChMQR0VB
TlQgVmVyZW5pZ2luZzEcMBoGA1UEAxMTR0VBTlQgUGVyc29uYWwgQ0EgNAIR
ALCI3SgYhalUCBgVAjDdCYowbAYJKoZIhvcNAQkPMV8wXTALBglghkgBZQME
ASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDAN
BggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDBsBgsqhkiG
9w0BCRACCzFdoFswRjELMAkGA1UEBhMCTkwxGTAXBgNVBAoTEEdFQU5UIFZl
cmVuaWdpbmcxHDAaBgNVBAMTE0dFQU5UIFBlcnNvbmFsIENBIDQCEQCwiN0o
GIWpVAgYFQIw3QmKMA0GCSqGSIb3DQEBAQUABIIBACAkWOdX0NGylAnUFXZk
130LQ/e92le4g4kMAtmHn8UfQX/0Fii9u9VGv9hSniBEJ6MyBRs+2SW0lMpB
K065GnpbiyYrJdP3rucub48uUWxrHNxVEnJXgLC6E9tz5n8jLfD3BH8T6Lp7
9BkWIyoT8oUId9JplPxFOtFBVjFvHv04O2lXOmfm2XXChunkMuzrdxw3naj+
/fzT0omHUBWOQBRpMFSY56NNeB6XojuDj8/Qh01wFtqEL4SxoJ+lfULnOJaj
I2Jn5OIlXukWsiPhUuaTF9Roz0kyjCv3KCzXYr2ptdKPkNZ+7hJu8MkwbrP2
NCaSV+L8jxNqUsA8HBb+Y6YAAAAAAAA=
--------------ms020707080607020403080104--
------------=_1691077010-724225-0
Content-Type: multipart/alternative;
boundary=------------oXmd7VtpWdyrA0hjOBR7NBpm;
boundary="----------=_1691077010-724225-1";
charset="UTF-8"
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.508 (Entity 5.508)
This is a multi-part message in MIME format...
------------=_1691077010-724225-1--
------------=_1691077010-724225-0--