Problem with Athena signed rsa pkcs
Carsten Mietzsch via Openvpn-users <[email protected]> Thu, 27 Nov 2025 10:34:37 +0000
| Newsgroups | gmane.network.openvpn.user |
|---|---|
| Message-ID | <BESPR09MB8310FBD12802C8796012DC3EF9DFA@BESPR09MB8310.eurprd09.prod.outlook.com> |
--===============0915740593248400181==
Content-Language: de-DE
Content-Type: multipart/alternative;
boundary="_000_BESPR09MB8310FBD12802C8796012DC3EF9DFABESPR09MB8310eurp_"
--_000_BESPR09MB8310FBD12802C8796012DC3EF9DFABESPR09MB8310eurp_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Hi,
We use Athena IDProtect tokens on the client side for pkcs#11 authenticatio=
n. While the client does not display any errors during the handshake via pk=
cs, we receive a rejection on the server side:
2025-11-27T08:31:26.281152+00:00 sgw02 ovpn-server[87519]: 192.168.51.159:5=
4312 Sent fatal SSL alert: decrypt error
2025-11-27T08:31:26.281207+00:00 sgw02 ovpn-server[87519]: 192.168.51.159:5=
4312 OpenSSL: error:02000068:rsa routines::bad signature::../crypto/rsa/rsa=
_pss.c:143:ossl_rsa_verify_PKCS1_PSS_mgf1
2025-11-27T08:31:26.281262+00:00 sgw02 ovpn-server[87519]: 192.168.51.159:5=
4312 OpenSSL: error:1C880004:Provider routines::RSA lib::../providers/imple=
mentations/signature/rsa_sig.c:1084:rsa_verify_directly
2025-11-27T08:31:26.281311+00:00 sgw02 ovpn-server[87519]: 192.168.51.159:5=
4312 OpenSSL: error:0A00007B:SSL routines::bad signature::../ssl/statem/sta=
tem_lib.c:582:tls_process_cert_verify
2025-11-27T08:31:26.281353+00:00 sgw02 ovpn-server[87519]: 192.168.51.159:5=
4312 TLS_ERROR: BIO read tls_read_plaintext error
2025-11-27T08:31:26.281402+00:00 sgw02 ovpn-server[87519]: 192.168.51.159:5=
4312 TLS Error: TLS object -> incoming plaintext read error
2025-11-27T08:31:26.281719+00:00 sgw02 ovpn-server[87519]: 192.168.51.159:5=
4312 TLS Error: TLS handshake failed
2025-11-27T08:31:26.281766+00:00 sgw02 ovpn-server[87519]: 192.168.51.159:5=
4312 PID packet_id_free
2025-11-27T08:31:26.281806+00:00 sgw02 ovpn-server[87519]: 192.168.51.159:5=
4312 PKCS#11: __pkcs11h_openssl_ex_data_free entered - parent=3D0x575b0f8c3=
cc0, ptr=3D(nil), ad=3D0x575b0f8c3d50, idx=3D1, argl=3D0, argp=3D0x72efb3a8=
0ac3
2025-11-27T08:31:26.281839+00:00 sgw02 ovpn-server[87519]: 192.168.51.159:5=
4312 PID packet_id_free
2025-11-27T08:31:26.281879+00:00 sgw02 ovpn-server[87519]: 192.168.51.159:5=
4312 PID packet_id_free
2025-11-27T08:31:26.281922+00:00 sgw02 ovpn-server[87519]: 192.168.51.159:5=
4312 TLS: tls_session_init: entry
2025-11-27T08:31:26.281956+00:00 sgw02 ovpn-server[87519]: 192.168.51.159:5=
4312 PID packet_id_init seq_backtrack=3D64 time_backtrack=3D15
2025-11-27T08:31:26.281995+00:00 sgw02 ovpn-server[87519]: 192.168.51.159:5=
4312 PID packet_id_init seq_backtrack=3D64 time_backtrack=3D15
2025-11-27T08:31:26.282023+00:00 sgw02 ovpn-server[87519]: 192.168.51.159:5=
4312 TLS: tls_session_init: new session object, sid=3Da9758fd7 30b00b25
2025-11-27T08:31:26.282068+00:00 sgw02 ovpn-server[87519]: 192.168.51.159:5=
4312 TLS: tls_multi_process: i=3D2 state=3DS_UNDEF, mysid=3D00000000 000000=
00, stored-sid=3D00000000 00000000, stored-ip=3D[AF_UNSPEC]
2025-11-27T08:31:26.282113+00:00 sgw02 ovpn-server[87519]: 192.168.51.159:5=
4312 Fatal TLS error (check_tls_errors_co), restarting
2025-11-27T08:31:26.282153+00:00 sgw02 ovpn-server[87519]: 192.168.51.159:5=
4312 SIGUSR1[soft,tls-error] received, client-instance restarting
2025-11-27T08:31:26.282196+00:00 sgw02 ovpn-server[87519]: MULTI: multi_clo=
se_instance called
ovpn is v2.6 and ossl has v3.5.4. We have already tried on both sides to en=
force
tls-cert-profile legacy
and tls 1.2.
Forcing ossl to legacy also did not help.
I suspect that the stick simply does not support pss, but we are also unabl=
e to get the server to accept the old procedure. The signature algorithm is=
sha256RSA.
Unfortunately, over 1000 tokens are already in the field and a worldwide re=
placement is difficult.
Has anyone had any experience with this or have any ideas about what we sho=
uld check or try?
Kind regards,
Charly
--_000_BESPR09MB8310FBD12802C8796012DC3EF9DFABESPR09MB8310eurp_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<html xmlns:o=3D"urn:schemas-microsoft-com:office:office" xmlns:w=3D"urn:sc=
hemas-microsoft-com:office:word" xmlns:m=3D"http://schemas.microsoft.com/of=
fice/2004/12/omml" xmlns=3D"http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;
mso-fareast-language:EN-US;}
span.E-MailFormatvorlage17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:11.0pt;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang=3D"DE" link=3D"#0563C1" vlink=3D"#954F72" style=3D"word-wrap:bre=
ak-word">
<div class=3D"WordSection1">
<p class=3D"MsoNormal">Hi,<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">We use Athena IDProtect tokens on the client side fo=
r pkcs#11 authentication. While the client does not display any errors duri=
ng the handshake via pkcs, we receive a rejection on the server side:<o:p><=
/o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">2025-11-27T08:31:26.281152+00:00 sgw02 ovpn-server[8=
7519]: 192.168.51.159:54312 Sent fatal SSL alert: decrypt error<o:p></o:p><=
/p>
<p class=3D"MsoNormal">2025-11-27T08:31:26.281207+00:00 sgw02 ovpn-server[8=
7519]: 192.168.51.159:54312 OpenSSL: error:02000068:rsa routines::bad signa=
ture::../crypto/rsa/rsa_pss.c:143:ossl_rsa_verify_PKCS1_PSS_mgf1<o:p></o:p>=
</p>
<p class=3D"MsoNormal">2025-11-27T08:31:26.281262+00:00 sgw02 ovpn-server[8=
7519]: 192.168.51.159:54312 OpenSSL: error:1C880004:Provider routines::RSA =
lib::../providers/implementations/signature/rsa_sig.c:1084:rsa_verify_direc=
tly<o:p></o:p></p>
<p class=3D"MsoNormal">2025-11-27T08:31:26.281311+00:00 sgw02 ovpn-server[8=
7519]: 192.168.51.159:54312 OpenSSL: error:0A00007B:SSL routines::bad signa=
ture::../ssl/statem/statem_lib.c:582:tls_process_cert_verify<o:p></o:p></p>
<p class=3D"MsoNormal">2025-11-27T08:31:26.281353+00:00 sgw02 ovpn-server[8=
7519]: 192.168.51.159:54312 TLS_ERROR: BIO read tls_read_plaintext error<o:=
p></o:p></p>
<p class=3D"MsoNormal">2025-11-27T08:31:26.281402+00:00 sgw02 ovpn-server[8=
7519]: 192.168.51.159:54312 TLS Error: TLS object -> incoming plaintext =
read error<o:p></o:p></p>
<p class=3D"MsoNormal">2025-11-27T08:31:26.281719+00:00 sgw02 ovpn-server[8=
7519]: 192.168.51.159:54312 TLS Error: TLS handshake failed<o:p></o:p></p>
<p class=3D"MsoNormal">2025-11-27T08:31:26.281766+00:00 sgw02 ovpn-server[8=
7519]: 192.168.51.159:54312 PID packet_id_free<o:p></o:p></p>
<p class=3D"MsoNormal">2025-11-27T08:31:26.281806+00:00 sgw02 ovpn-server[8=
7519]: 192.168.51.159:54312 PKCS#11: __pkcs11h_openssl_ex_data_free entered=
- parent=3D0x575b0f8c3cc0, ptr=3D(nil), ad=3D0x575b0f8c3d50, idx=3D1, argl=
=3D0, argp=3D0x72efb3a80ac3<o:p></o:p></p>
<p class=3D"MsoNormal">2025-11-27T08:31:26.281839+00:00 sgw02 ovpn-server[8=
7519]: 192.168.51.159:54312 PID packet_id_free<o:p></o:p></p>
<p class=3D"MsoNormal">2025-11-27T08:31:26.281879+00:00 sgw02 ovpn-server[8=
7519]: 192.168.51.159:54312 PID packet_id_free<o:p></o:p></p>
<p class=3D"MsoNormal">2025-11-27T08:31:26.281922+00:00 sgw02 ovpn-server[8=
7519]: 192.168.51.159:54312 TLS: tls_session_init: entry<o:p></o:p></p>
<p class=3D"MsoNormal">2025-11-27T08:31:26.281956+00:00 sgw02 ovpn-server[8=
7519]: 192.168.51.159:54312 PID packet_id_init seq_backtrack=3D64 time_back=
track=3D15<o:p></o:p></p>
<p class=3D"MsoNormal">2025-11-27T08:31:26.281995+00:00 sgw02 ovpn-server[8=
7519]: 192.168.51.159:54312 PID packet_id_init seq_backtrack=3D64 time_back=
track=3D15<o:p></o:p></p>
<p class=3D"MsoNormal">2025-11-27T08:31:26.282023+00:00 sgw02 ovpn-server[8=
7519]: 192.168.51.159:54312 TLS: tls_session_init: new session object, sid=
=3Da9758fd7 30b00b25<o:p></o:p></p>
<p class=3D"MsoNormal">2025-11-27T08:31:26.282068+00:00 sgw02 ovpn-server[8=
7519]: 192.168.51.159:54312 TLS: tls_multi_process: i=3D2 state=3DS_UNDEF, =
mysid=3D00000000 00000000, stored-sid=3D00000000 00000000, stored-ip=3D[AF_=
UNSPEC]<o:p></o:p></p>
<p class=3D"MsoNormal">2025-11-27T08:31:26.282113+00:00 sgw02 ovpn-server[8=
7519]: 192.168.51.159:54312 Fatal TLS error (check_tls_errors_co), restarti=
ng<o:p></o:p></p>
<p class=3D"MsoNormal">2025-11-27T08:31:26.282153+00:00 sgw02 ovpn-server[8=
7519]: 192.168.51.159:54312 SIGUSR1[soft,tls-error] received, client-instan=
ce restarting<o:p></o:p></p>
<p class=3D"MsoNormal">2025-11-27T08:31:26.282196+00:00 sgw02 ovpn-server[8=
7519]: MULTI: multi_close_instance called<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">ovpn is v2.6 and ossl has v3.5.4. We have already tr=
ied on both sides to enforce
<o:p></o:p></p>
<p class=3D"MsoNormal">tls-cert-profile legacy<o:p></o:p></p>
<p class=3D"MsoNormal">and tls 1.2.<o:p></o:p></p>
<p class=3D"MsoNormal">Forcing ossl to legacy also did not help.<o:p></o:p>=
</p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">I suspect that the stick simply does not support pss=
, but we are also unable to get the server to accept the old procedure. The=
signature algorithm is sha256RSA.<o:p></o:p></p>
<p class=3D"MsoNormal">Unfortunately, over 1000 tokens are already in the f=
ield and a worldwide replacement is difficult.<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">Has anyone had any experience with this or have any =
ideas about what we should check or try?<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">Kind regards,<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">Charly<o:p></o:p></p>
</div>
</body>
</html>
--_000_BESPR09MB8310FBD12802C8796012DC3EF9DFABESPR09MB8310eurp_--
--===============0915740593248400181==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
--===============0915740593248400181==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users
--===============0915740593248400181==--