RE: Successfully imported certificates fail with "error finding client identity keys"

For anyone who might run into this same problem later on - this issue
appears to be due to running the net-snmp-cert import command referencing 2
or more cert/key pair file names that are actually identical in content,
have identical fingerprints, but have different file names.

 

For example, if you have a cert/key pair in files cert1.crt and cert1.key,
and then copy those files to cert2.crt and cert2.key, and then import both
pairs under different names, then when you later attempt to reference either
cert by name via the "-T" option with any of the various snmp commands,
those commands will core dump.

 

When I deleted such duplicate cert/key files from the net-snmp cert/key
store folders and re-ran these commands, I no longer saw the core dumps.

 

From: James [mailto:[email protected]] 
Sent: Wednesday, November 10, 2010 8:52 AM
To: '[email protected]'
Subject: RE: Successfully imported certificates fail with "error finding
client identity keys"

 

I do not know whether or not this issue is cygwin specific.  We do not have
a Linux test environment to compare behavior.  Does anybody know whether
it's possible to "un-import" identities from net-snmp imported using
net-snmp-cert import?

 

From: [email protected] [mailto:[email protected]] On Behalf
Of Bart Van Assche
Sent: Monday, November 08, 2010 4:08 AM
To: James Martin
Cc: [email protected]
Subject: Re: Successfully imported certificates fail with "error finding
client identity keys"

 

On Sat, Nov 6, 2010 at 2:07 AM, James Martin
<[email protected]> wrote:

I am testing a DTLS snmp server using net-snmp version 5.6 on windows under
cygwin as the client.

 

I have several certificates that I have imported successfully using
net-snmp-cert -t <friendly name> <cert_file_name> <key_file_name>

 

When I use net-snmp-cert showcerts <friendly name>, it successfully finds
the corresponding cert and dumps out info from it without issue.

 

However, when I issue any snmp command using the same friendly name, such as
snmpget, I get the following output:

 

$ snmpget -v 3 -s tsm -t 10 -l authPriv -m +ALL -e
"00000063000000A1000A0000A01

3" -T our_identity= client_cert_name -T their_identity=server_cert_name
dtlsudp:192.168.1.97:10161 snmpTsmConfigurationUsePrefix.0

 

No log handling enabled - using stderr logging

hash type none not supported. using SHA1

error finding client identity keys

failed to create the SSL session structure

failed to open a new dtls connection

snmpget: Failure in sendto (Sub-id not found: (top) ->
snmpTsmConfigurationUsePr

efix) (No such file or directory)

Segmentation fault (core dumped)

 

Different certs give me different errors, and it seems like all of the certs
that give me errors have been imported more than once under different
friendly names.  Can this cause this problem?  Is there away to clean out
the certificate store and remove all registered friendly names and start
from scratch?

 

Any other suggestions?


Is this issue Cygwin-specific ? What happens if you run the same command on
Linux after having built the same source tree with the configure command you
used on Cygwin ?

Bart.

------------------------------------------------------------------------------
Centralized Desktop Delivery: Dell and VMware Reference Architecture
Simplifying enterprise desktop deployment and management using
Dell EqualLogic storage and VMware View: A highly scalable, end-to-end
client virtualization framework. Read more!
http://p.sf.net/sfu/dell-eql-dev2dev

_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users