Re: Cyrus IMAP + Client certificate authentication
Johannes Eckhardt <[email protected]> Thu, 3 Aug 2023 19:26:09 +0200
| Newsgroups | gmane.comp.security.cyrus.sasl |
|---|---|
| Organization | Institut für Höhere Studien - Institute fo r Advanced Studies (IHS) |
| Message-ID | <[email protected]> |
------------=_1691083678-331641-0
Content-Language: en-US
Content-Type: multipart/signed;
boundary=------------ms060105010509060207090405; micalg=sha-256;
protocol="application/pkcs7-signature"
Content-Transfer-Encoding: 7bit
--------------ms060105010509060207090405
Content-Type: multipart/alternative;
boundary=------------1066nyMqGWdzh0RW0y0CqdQA
Content-Transfer-Encoding: 7bit
--------------1066nyMqGWdzh0RW0y0CqdQA
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
It works when trying with openssl and the K-9 mobile client. Thunderbird
still refuses connection - I'll need to spent some more time.
Thanks for your advise!!
Best,
Johannes
On 03.08.2023 17:35, Johannes Eckhardt wrote:
> On 03.08.2023 14:37, Ken Hornstein via SASL wrote:
>> As part of the TLS negotiation the TLS server tells the client, "here's
>> a list of CA's I will accept client certificates for". So the first
>> question I would ask is, "Is Cyrus sending a list of CAs?" You can check
>> this with the openssl command line utility "s_client". E.g.:
>>
>> % openssl s_client -starttls imap -connect imap-server:143
>>
>> You'll see a bunch of stuff printed out. What you WANT to see is:
>>
>> Acceptable client certificate CA names
>> /C=CA-name/CN=your CA 1
>> /C=CA-name/CN=your CA 2
>> [...]
>
> I can see that list - so that part should be ok.
>
>> The list of CAs sent I _believe_ is controlled by the config file
>> entry "tls_client_ca_file" (you should also probably set tls_client_ca_dir
>> pointing to a hashed directory containing the complete certificate
>> bundle for your PKI). Also note the "tls_client_certs" entry which controls
>> whether or not a client certificate is optional, required, or disabled.
>> I also remember seeing that if you crank up logging on the IMAP server
>> it should log the certificate commonName if one was presented.
>>
>> I see that openssl s_client also supports sending a client certificate
>> so you could test things out that way (I don't know if you're using
>> a smartcard or not, it looks like only newer openssls support that and
>> getting a smartcard working with openssl is a pain).
>
> I'm using a "normal" certificate - no smartcard. Trying to
> authenticate using openssl is a good advise. The next few days I won't
> have much time to spent on that but I'll get back to you next week.
>
> Best,
>
> Johannes
>
--------------1066nyMqGWdzh0RW0y0CqdQA
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>It works when trying with openssl and the K-9 mobile client.
Thunderbird still refuses connection - I'll need to spent some
more time.</p>
<p>Thanks for your advise!!</p>
<p>Best,</p>
<p>Johannes<br>
</p>
<p><br>
</p>
<p>On 03.08.2023 17:35, Johannes Eckhardt wrote:</p>
<blockquote type="cite"
cite="mid:[email protected]">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<div class="moz-cite-prefix">On 03.08.2023 14:37, Ken Hornstein
via SASL wrote:<br>
</div>
<blockquote type="cite"
cite="mid:[email protected]"><span
style="white-space: pre-wrap">
</span>
<pre class="moz-quote-pre" wrap="">As part of the TLS negotiation the TLS server tells the client, "here's
a list of CA's I will accept client certificates for". So the first
question I would ask is, "Is Cyrus sending a list of CAs?" You can check
this with the openssl command line utility "s_client". E.g.:
% openssl s_client -starttls imap -connect imap-server:143
You'll see a bunch of stuff printed out. What you WANT to see is:
Acceptable client certificate CA names
/C=CA-name/CN=your CA 1
/C=CA-name/CN=your CA 2
[...]
</pre>
</blockquote>
<p>I can see that list - so that part should be ok.</p>
<blockquote type="cite"
cite="mid:[email protected]">
<pre class="moz-quote-pre" wrap="">The list of CAs sent I _believe_ is controlled by the config file
entry "tls_client_ca_file" (you should also probably set tls_client_ca_dir
pointing to a hashed directory containing the complete certificate
bundle for your PKI). Also note the "tls_client_certs" entry which controls
whether or not a client certificate is optional, required, or disabled.
I also remember seeing that if you crank up logging on the IMAP server
it should log the certificate commonName if one was presented.
I see that openssl s_client also supports sending a client certificate
so you could test things out that way (I don't know if you're using
a smartcard or not, it looks like only newer openssls support that and
getting a smartcard working with openssl is a pain).</pre>
</blockquote>
<p>I'm using a "normal" certificate - no smartcard. Trying to
authenticate using openssl is a good advise. The next few days I
won't have much time to spent on that but I'll get back to you
next week.</p>
<p>Best,</p>
<p>Johannes<br>
</p>
</blockquote>
</body>
</html>
--------------1066nyMqGWdzh0RW0y0CqdQA--
--------------ms060105010509060207090405
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature
MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG
9w0BBwEAAKCCDXowggaMMIIEdKADAgECAhEAsIjdKBiFqVQIGBUCMN0JijAN
BgkqhkiG9w0BAQwFADBGMQswCQYDVQQGEwJOTDEZMBcGA1UEChMQR0VBTlQg
VmVyZW5pZ2luZzEcMBoGA1UEAxMTR0VBTlQgUGVyc29uYWwgQ0EgNDAeFw0y
MTExMDgwMDAwMDBaFw0yNDExMDcyMzU5NTlaMIHpMQ0wCwYDVQQREwQxMDgw
MUswSQYDVQQKDEJJbnN0aXR1dCBmw7xyIEjDtmhlcmUgU3R1ZGllbi1JbnN0
aXR1dGUgZm9yIEFkdmFuY2VkIFN0dWRpZXMgKElIUykxITAfBgNVBAkMGEpv
c2Vmc3TDpGR0ZXIgU3RyYcOfZSAzOTENMAsGA1UECBMEV2llbjENMAsGA1UE
BxMEV2llbjELMAkGA1UEBhMCQVQxGjAYBgNVBAMTEUpvaGFubmVzIEVja2hh
cmR0MSEwHwYJKoZIhvcNAQkBFhJqb2hhbm5lc0BpaHMuYWMuYXQwggEiMA0G
CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHUC7R/i9ODG+skdq8TAU3hqnc
wBtHDO6rTJFunDbSvyk3jYJiZ76wEf+fKHbR+oCDI5Sd8KqykQ1HyWwUUl8r
65NlCo6Iw8WLauUnlFLH4WNys4lTSHud0uXdd4ey0/NJAhgWr/qZlrzS2L+U
BA8+vz31CB0WEw4zQWwVMovPdd9M5fNtTYhVtOv9bra/LaeNaAKrFuRbtnGY
pGiLJwuyvNhX37QQdzJTNtaOB5TP0Gona0HqI37oKVesd2B/EVA113Elnf+v
yCKA5HKMUpeD5nDsfG+ayXEh9PEYbrg96UMCUmlIaqbiNNVOFqsNhJHQKyjk
hPIE7bIUKu7r87Y1AgMBAAGjggHPMIIByzAfBgNVHSMEGDAWgBRpAKHHIVj4
4MUbILAK3adRvxPZ5DAdBgNVHQ4EFgQUyJoz+WNI7uAeTqJ0j6hCWrMbYpIw
DgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYB
BQUHAwQGCCsGAQUFBwMCMD8GA1UdIAQ4MDYwNAYLKwYBBAGyMQECAk8wJTAj
BggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwQgYDVR0fBDsw
OTA3oDWgM4YxaHR0cDovL0dFQU5ULmNybC5zZWN0aWdvLmNvbS9HRUFOVFBl
cnNvbmFsQ0E0LmNybDB4BggrBgEFBQcBAQRsMGowPQYIKwYBBQUHMAKGMWh0
dHA6Ly9HRUFOVC5jcnQuc2VjdGlnby5jb20vR0VBTlRQZXJzb25hbENBNC5j
cnQwKQYIKwYBBQUHMAGGHWh0dHA6Ly9HRUFOVC5vY3NwLnNlY3RpZ28uY29t
ME0GA1UdEQRGMESBG0pvaGFubmVzLkVja2hhcmR0QGlocy5hYy5hdIERaG90
bGluZUBpaHMuYWMuYXSBEmpvaGFubmVzQGlocy5hYy5hdDANBgkqhkiG9w0B
AQwFAAOCAgEAk88tD84oCgTEVZUmI2WatrEAYK2lSl7xePrLvd+EP5ttSnRr
I/SdaMOW8QtyiQJEL0EuZ7+Ps44Ltxh99FeDFrcmqIMreH81iEBzauDapCZP
IeUEk8bRaK4qSsE+uhwfYwR0wcONpXq9kl6f1VOgYsnjsNAw7/3ohegShKyB
XijTuVC4XYNTIREXC/hmOy+ai8/SaFOIBumbIz9TZnmmgmu7w+jutmZv2ZoB
OtUdJzWL6fPXdz36FY4oNlayKY2Er+keJBsa6Lt/SUcqOEArqGaGT08n2Rdi
qyt+RVxe6CtdljcB9R1cT0/dxnlf6a8hkiZPeiW7lfJlZYLBWD8jbT35BCuL
9XEbn/pU41Q2h7+FF0n5YRqd0S6730onoVrNsCkY8xBJK95KGTuQnUwUfnp+
Ng8WdVHOa7u8OYnrWfK7wFgQ7DK+zFK7pRM+cY8Sf13IVJQ7CobRwQjyOHQd
fTwpeDr5k0mhkMiR95MbfLNI7CfG0IUiGktoJg6N/o+6bpjiJYnbTSgzmMT+
D2bOHiCLI9nDmqSovx45R/i82bhTHgkhQ6fr+INeSYI5TNuiKkcHhzaOmoD6
LzMnq1KntnVt7XQwHC/2Gem+FSCPwRi4QkCCDQSxftzygJh9772EgbQEtZD6
cn8Hcl8elJCcIOJbCsgx7rulpOKXV5xvq+8wggbmMIIEzqADAgECAhAxAnDU
Nb6bJJr4VtDh4oVJMA0GCSqGSIb3DQEBDAUAMIGIMQswCQYDVQQGEwJVUzET
MBEGA1UECBMKTmV3IEplcnNleTEUMBIGA1UEBxMLSmVyc2V5IENpdHkxHjAc
BgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEuMCwGA1UEAxMlVVNFUlRy
dXN0IFJTQSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0yMDAyMTgwMDAw
MDBaFw0zMzA1MDEyMzU5NTlaMEYxCzAJBgNVBAYTAk5MMRkwFwYDVQQKExBH
RUFOVCBWZXJlbmlnaW5nMRwwGgYDVQQDExNHRUFOVCBQZXJzb25hbCBDQSA0
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAs0riIl4nW+kEWxQE
NTIgFK600jFAxs1QwB6hRMqvnkphfy2Q3mKbM2otpELKlgE8/3AQPYBo7p7y
eORuPMnAuA+oMGRb2wbeSaLcZbpwXgfCvnKxmq97/kQkOFX706F9O7/h0yeh
HhDjUdyMyT0zMs4AMBDRrAFn/b2vR3j0BSYgoQs16oSqadM3p+d0vvH/YrRM
tOhkvGpLuzL8m+LTAQWvQJ92NwCyKiHspoP4mLPJvVpEpDMnpDbRUQdftSpZ
zVKTNORvPrGPRLnJ0EEVCHR82LL6oz915WkrgeCY9ImuulBn4uVsd9ZpubCg
M/EXvVBlViKqusChSsZEn7juIsGIiDyaIhhLsd3amm8BS3bgK6AxdSMROND6
hiHT182Lmf8C+gRHxQG9McvG35uUvRu8v7bPZiJRaT7ZC2f50P4lTlnbLvWp
Xv5yv7hheO8bMXltiyLweLB+VNvg+GnfL6TW3Aq1yF1yrZAZzR4MbpjTWdEd
SLKvz8+0wCwscQ81nbDOwDt9vyZ+0eJXbRkWZiqScnwAg5/B1NUD4TrYlrI4
n6zFp2pyYUOiuzP+as/AZnz63GvjFK69WODR2W/TK4D7VikEMhg18vhuRf4h
xnWZOy0vhfDR/g3aJbdsGac+diahjEwzyB+UKJOCyzvecG8bZ/u/U8PsEMZg
07iIPi8CAwEAAaOCAYswggGHMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvA
nfKyA2bLMB0GA1UdDgQWBBRpAKHHIVj44MUbILAK3adRvxPZ5DAOBgNVHQ8B
Af8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHSUEFjAUBggrBgEF
BQcDAgYIKwYBBQUHAwQwOAYDVR0gBDEwLzAtBgRVHSAAMCUwIwYIKwYBBQUH
AgEWF2h0dHBzOi8vc2VjdGlnby5jb20vQ1BTMFAGA1UdHwRJMEcwRaBDoEGG
P2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZp
Y2F0aW9uQXV0aG9yaXR5LmNybDB2BggrBgEFBQcBAQRqMGgwPwYIKwYBBQUH
MAKGM2h0dHA6Ly9jcnQudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FBZGRU
cnVzdENBLmNydDAlBggrBgEFBQcwAYYZaHR0cDovL29jc3AudXNlcnRydXN0
LmNvbTANBgkqhkiG9w0BAQwFAAOCAgEACgVOew2PHxM5AP1v7GLGw+3tF6rj
Acx43D9Hl110Q+BABABglkrPkES/VyMZsfuds8fcDGvGE3o5UfjSno4sij0x
dKut8zMazv8/4VMKPCA3EUS0tDUoL01ugDdqwlyXuYizeXyH2ICAQfXMtS+r
az7mf741CZvO50OxMUMxqljeRfVPDJQJNHOYi2pxuxgjKDYx4hdZ9G2o+oLl
Hhu5+anMDkE8g0tffjRKn8I1D1BmrDdWR/IdbBOj6870abYvqys1qYlPotv5
N5dm+XxQ8vlrvY7+kfQaAYeO3rP1DM8BGdpEqyFVa+I0rpJPhaZkeWW7cImD
QFerHW9bKzBrCC815a3WrEhNpxh72ZJZNs1HYJ+29NTB6uu4NJjaMxpk+g2p
uNSm4b9uVjBbPO9V6sFSG+IBqE9ckX/1XjzJtY8Grqoo4SiRb6zcHhp3mxj3
oqWi8SKNohAOKnUc7RIP6ss1hqIFyv0xXZor4N9tnzD0Fo0JDIURjDPEgo5W
Tdti/MdGTmKFQNqxyZuT9uSI2Xvhz8p+4pCYkiZqpahZlHqMFxdw9XRZQgrP
+cgtOkWEaiNkRBbvtvLdp7MCL2OsQhQEdEbUvDM9slzZXdI7NjJokVBq3O4p
ls3VD2z3L/bHVBe0rBERjyM2C/HSIh84rfmAqBgklzIOqXhd+4RzadUxggM7
MIIDNwIBATBbMEYxCzAJBgNVBAYTAk5MMRkwFwYDVQQKExBHRUFOVCBWZXJl
bmlnaW5nMRwwGgYDVQQDExNHRUFOVCBQZXJzb25hbCBDQSA0AhEAsIjdKBiF
qVQIGBUCMN0JijANBglghkgBZQMEAgEFAKCCAbEwGAYJKoZIhvcNAQkDMQsG
CSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMjMwODAzMTcyNjA5WjAvBgkq
hkiG9w0BCQQxIgQgMiop8y92OBX/c8LNH7v3pAdH3H4lgp4pykAvb1wuZvIw
agYJKwYBBAGCNxAEMV0wWzBGMQswCQYDVQQGEwJOTDEZMBcGA1UEChMQR0VB
TlQgVmVyZW5pZ2luZzEcMBoGA1UEAxMTR0VBTlQgUGVyc29uYWwgQ0EgNAIR
ALCI3SgYhalUCBgVAjDdCYowbAYJKoZIhvcNAQkPMV8wXTALBglghkgBZQME
ASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDAN
BggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDBsBgsqhkiG
9w0BCRACCzFdoFswRjELMAkGA1UEBhMCTkwxGTAXBgNVBAoTEEdFQU5UIFZl
cmVuaWdpbmcxHDAaBgNVBAMTE0dFQU5UIFBlcnNvbmFsIENBIDQCEQCwiN0o
GIWpVAgYFQIw3QmKMA0GCSqGSIb3DQEBAQUABIIBACeuDmxUeQaycL8dgQVZ
ge9f16ZWMyjXN+VIUyLVwei/N6ywgC3gCzhF5meaensgtPUzlD971BbBTLfa
ce2cfk9sqi0dJB0na7f8ZZ5pslgiHIErStExgUC/K2yNitf2+HXjKg/VKQKt
5P7IvnNV2XzBhXpy0vBGEUw5/mEJwt5hIIqNlae1FFGJeD6gmLNhOShF1j5f
LOSc9vyiug8i0DXYgzjvKvCEfmuaBrn+5XlNZsISri1T4HITZPoJjSUFBmyl
WnZji8If6b4kTQ7h+5FRNhzV3FtBMBRMbeFbAdcUyyobcWheR1vg96ZOxicG
w/NpuoZOSmPGzv8r33kF2vcAAAAAAAA=
--------------ms060105010509060207090405--
------------=_1691083678-331641-0
Content-Type: multipart/alternative;
boundary=------------1066nyMqGWdzh0RW0y0CqdQA;
boundary="----------=_1691083678-331641-1";
charset="UTF-8"
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.508 (Entity 5.508)
This is a multi-part message in MIME format...
------------=_1691083678-331641-1--
------------=_1691083678-331641-0--