Error finding server identity keys

--===============0643116047865267894==
Content-Type: multipart/alternative; boundary="000000000000c67bae062919f8c4"

--000000000000c67bae062919f8c4
Content-Type: text/plain; charset="UTF-8"

NET-SNMP version: 5.9.4
 net-snmp-config --config-options
 '--with-security-modules=tsm' '--with-transports=TLSTCP,DTLSUDP'
'--with-mib-modules=tsm-mib'

OpenSSL 3.0.13 30 Jan 2024 (Library: OpenSSL 3.4.0 22 Oct 2024)

OS
Welcome to Ubuntu 24.04.1 LTS (GNU/Linux 5.15.167.4-microsoft-standard-WSL2
x86_64)

Relevant config lines snmpd.conf - No snmp.conf used
agentaddress tlstcp:1161

# certificate local defines the default X.509 public key to use as  the
 server's  identity (man pgs Ubuntu snmpd.conf)
[snmp] localCert /usr/local/share/snmp/tls/certs/snmpd.crt

# certificate common name danderson e.g CN = danderson
# /usr/local/share/snmp/tls/certs/manager.crt: SHA1
Fingerprint=4A:DB:1F:38:C8:59:E9:09:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98
certSecName 10 4A:DB:1F:38:C8:59:E9:09:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98
--cn

# SNMP v3 user. Security model -s
rwuser -s tsm danderson auth

Output from snmpd using: sudo /usr/local/sbin/snmpd -f -Lo -Dcert -C -c
snmpd.conf
---->snip<---
cert:dump: ------------------------ End ----------------------
cert:util:config: parsing 10
4A:DB:1F:38:C8:59:E9:09:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98 --cn
cert:find:params: looking for remote_peer(2) in MULTIPLE(0x200), hint
0x7ffd493e92d0
cert:find:params: looking for remote_peer(2) in FINGERPRINT(0x2), hint
0x7ffd493e92d0
cert:find:params:  hint =
4A:DB:1F:38:C8:59:E9:09:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98
cert:find:found: using cert manager.crt /
4adb1f38c859e90958dfcc4a5f30394a53fb3198 for remote_peer(2)
(uses=identity+remote_peer (3))
cert:find:found: using cert manager.crt /
4adb1f38c859e90958dfcc4a5f30394a53fb3198 for remote_peer(2)
(uses=identity+remote_peer (3))
cert:map:add: pri 10, fp 4adb1f38c859e90958dfcc4a5f30394a53fb3198
cert:find:params: looking for identity(1) in DEFAULT(0x0), hint (nil)
cert:find:params: looking for identity(1) in MULTIPLE(0x200), hint
0x5573fdf68c60
cert:find:params: looking for identity(1) in FINGERPRINT(0x2), hint
0x5573fdf68c60
cert:find:params:  hint = /usr/local/share/snmp/tls/certs/snmpd.crt
cert:find:params: looking for identity(1) in FILE(0x1), hint 0x5573fdf68c60
cert:find:params:  hint = /usr/local/share/snmp/tls/certs/snmpd.crt
error finding server identity keys

I have tested the certificates/keys using:
sudo openssl s_server -cert /usr/local/share/snmp/tls/certs/snmpd.crt -key
/usr/local/share/snmp/tls/private/snmpd.key -CAfile
/usr/local/share/snmp/tls/ca-certs/ca.snmp.dev.crt   -accept 1161 -tls1_2
-www

sudo openssl s_client -connect 127.0.0.1:1161 -tls1_2 -CAfile
/usr/local/share/snmp/tls/ca-certs/ca.snmp.dev.crt -cert
/usr/local/share/snmp/tls/certs/manager.crt -key
/usr/local/share/snmp/tls/private/manager.key

All good with the certificates generated using *net-snmp-cert*

This error appears a number of times in the net-snmp mailing list archives
- without any obvious explanation or fix. If this is a: "well you're not
running on a native Linux machine" problem then it would be really helpful
to have it fixed. Since Linux is being run more often than ever on Windows
machines.

I have found the code references and could possibly recompile with
additional debug lines. But I was hoping someone may have an easier
solution.

Regards
David Anderson

--000000000000c67bae062919f8c4
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">NET-SNMP version: 5.9.4<div>=C2=A0net-snmp-config --config=
-options<br>=C2=A0&#39;--with-security-modules=3Dtsm&#39; &#39;--with-trans=
ports=3DTLSTCP,DTLSUDP&#39; &#39;--with-mib-modules=3Dtsm-mib&#39;</div><di=
v><br></div><div>OpenSSL 3.0.13 30 Jan 2024 (Library: OpenSSL 3.4.0 22 Oct =
2024)<br><div><br></div></div><div>OS</div><div>Welcome to Ubuntu 24.04.1 L=
TS (GNU/Linux 5.15.167.4-microsoft-standard-WSL2 x86_64)</div><div><br></di=
v><div>Relevant config lines snmpd.conf - No snmp.conf used</div><div>agent=
address tlstcp:1161<br><br># certificate local defines the default X.509 pu=
blic key to use as =C2=A0the =C2=A0server&#39;s =C2=A0identity (man pgs Ubu=
ntu snmpd.conf)<br>[snmp] localCert /usr/local/share/snmp/tls/certs/snmpd.c=
rt<br><br># certificate common name danderson e.g CN =3D danderson<br># /us=
r/local/share/snmp/tls/certs/manager.crt: SHA1 Fingerprint=3D4A:DB:1F:38:C8=
:59:E9:09:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98<br>certSecName 10 4A:DB:1F:38=
:C8:59:E9:09:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98 --cn<br><br># SNMP v3 user=
. Security model -s<br>rwuser -s tsm danderson auth</div><div><br></div><di=
v>Output from snmpd using:=C2=A0sudo /usr/local/sbin/snmpd -f -Lo -Dcert -C=
 -c snmpd.conf</div><div>----&gt;snip&lt;---</div><div>cert:dump: ---------=
--------------- End ----------------------<br>cert:util:config: parsing 10 =
4A:DB:1F:38:C8:59:E9:09:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98 --cn<br>cert:fi=
nd:params: looking for remote_peer(2) in MULTIPLE(0x200), hint 0x7ffd493e92=
d0<br>cert:find:params: looking for remote_peer(2) in FINGERPRINT(0x2), hin=
t 0x7ffd493e92d0<br>cert:find:params: =C2=A0hint =3D 4A:DB:1F:38:C8:59:E9:0=
9:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98<br>cert:find:found: using cert manage=
r.crt / 4adb1f38c859e90958dfcc4a5f30394a53fb3198 for remote_peer(2) (uses=
=3Didentity+remote_peer (3))<br>cert:find:found: using cert manager.crt / 4=
adb1f38c859e90958dfcc4a5f30394a53fb3198 for remote_peer(2) (uses=3Didentity=
+remote_peer (3))<br>cert:map:add: pri 10, fp 4adb1f38c859e90958dfcc4a5f303=
94a53fb3198<br>cert:find:params: looking for identity(1) in DEFAULT(0x0), h=
int (nil)<br>cert:find:params: looking for identity(1) in MULTIPLE(0x200), =
hint 0x5573fdf68c60<br>cert:find:params: looking for identity(1) in FINGERP=
RINT(0x2), hint 0x5573fdf68c60<br>cert:find:params: =C2=A0hint =3D /usr/loc=
al/share/snmp/tls/certs/snmpd.crt<br>cert:find:params: looking for identity=
(1) in FILE(0x1), hint 0x5573fdf68c60<br>cert:find:params: =C2=A0hint =3D /=
usr/local/share/snmp/tls/certs/snmpd.crt<br>error finding server identity k=
eys</div><div><br></div><div>I have tested the certificates/keys using:</di=
v><div>sudo openssl s_server -cert /usr/local/share/snmp/tls/certs/snmpd.cr=
t -key /usr/local/share/snmp/tls/private/snmpd.key -CAfile /usr/local/share=
/snmp/tls/ca-certs/ca.snmp.dev.crt =C2=A0 -accept 1161 -tls1_2 -www</div><d=
iv><br></div><div>sudo openssl s_client -connect <a href=3D"http://127.0.0.=
1:1161">127.0.0.1:1161</a> -tls1_2 -CAfile /usr/local/share/snmp/tls/ca-cer=
ts/ca.snmp.dev.crt -cert /usr/local/share/snmp/tls/certs/manager.crt -key /=
usr/local/share/snmp/tls/private/manager.key</div><div><br></div><div>All g=
ood with the certificates generated using <b>net-snmp-cert</b>=C2=A0</div><=
div><br></div><div>This error appears a number of times in the net-snmp mai=
ling list archives - without any obvious explanation or fix. If this is a: =
&quot;well you&#39;re not running on a native Linux machine&quot; problem t=
hen it would be really helpful to have it fixed. Since Linux is being run m=
ore often than ever on Windows machines.</div><div><br></div><div>I have fo=
und the code references and could possibly recompile with additional debug =
lines. But I was hoping someone may have an easier solution.</div><div><br>=
</div><div>Regards</div><div>David Anderson</div><div><br></div></div>

--000000000000c67bae062919f8c4--


--===============0643116047865267894==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============0643116047865267894==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users

--===============0643116047865267894==--