[tpm2] Re: tpm2-tss fapi tests failing with new openssl

The EK-CA for the test harness is built right here:
https://github.com/tpm2-software/tpm2-tss/tree/master/script/ekca

I hope this helps with debugging.
If not just ask me more...

________________________________________
Von: Petr Gotthard <petr.gotthard(a)centrum.cz>
Gesendet: Montag, 28. Juni 2021 11:55
An: tpm2(a)lists.01.org
Betreff: [tpm2] tpm2-tss fapi tests failing with new openssl

Hello,

I have troubles debugging the FAPI tests. I am seeing error messages "Could not open file or uri for loading certificate", but I have no idea where these are coming from. For example, in "tpm2-tss/test/integration/fapi-data-crypt-rsa.log" I see

Could not open file or uri for loading certificate from /home/petr/projects/tpm2-tss/test/integration/fapi-data-crypt-rsa.fint_ekcert.crt
C05DA65E427F0000:error:80000002:system library:file_open:No such file or directory::0:calling stat(/home/petr/projects/tpm2-tss/test/integration/fapi-data-crypt-rsa.fint_ekcert.crt)
Unable to load certificate
Could not open file or uri for loading certificate from /home/petr/projects/tpm2-tss/test/integration/fapi-data-crypt-rsa.fint_ekecccert.crt
C08D22FEE77F0000:error:80000002:system library:file_open:No such file or directory::0:calling stat(/home/petr/projects/tpm2-tss/test/integration/fapi-data-crypt-rsa.fint_ekecccert.crt)
Unable to load certificate
cat: /home/petr/projects/tpm2-tss/test/integration/fapi-data-crypt-rsa.fint_ekcert.crt: No such file or directory
WARNING:test:test/helper/tpm_writeekcert.c:92:main() Cert input size is 0
WARNING:test:test/helper/tpm_writeekcert.c:95:main() Define NV cert with nv index: 1c00002
cat: /home/petr/projects/tpm2-tss/test/integration/fapi-data-crypt-rsa.fint_ekecccert.crt: No such file or directory
WARNING:test:test/helper/tpm_writeekcert.c:92:main() Cert input size is 0
WARNING:test:test/helper/tpm_writeekcert.c:95:main() Define NV cert with nv index: 1c0000a
Execute the test script


The "tpm2-tss/test/integration/fapi-data-crypt-rsa.fint_ca.log" indicates(?) these files should(?) have been created:

Creating ekcert for /home/petr/projects/tpm2-tss/test/integration/fapi-data-crypt-rsa.fint_ekpub.pem => /home/petr/projects/tpm2-tss/test/integration/fapi-data-crypt-rsa.fint_ekcert.crt
Creating ekcert for /home/petr/projects/tpm2-tss/test/integration/fapi-data-crypt-rsa.fint_ekeccpub.pem => /home/petr/projects/tpm2-tss/test/integration/fapi-data-crypt-rsa.fint_ekecccert.crt

But the certificates are not there. The PEM keys yes, the CRT files no.

I tried to find which openssl(?) command does this certificate creation, but it is somewhere well hidden.


This is not a bug in the tpm2-tss. I am using the new OpenSSL 3.0 and my heavily modified tpm2-tss code. The bug is in one of these two-- I have just serious troubles finding it.

Could you please give me some hint where should I look? Where is the command generating these certificates, please?



Kind Regards,
Petr

_______________________________________________
tpm2 mailing list -- tpm2(a)lists.01.org
To unsubscribe send an email to tpm2-leave(a)lists.01.org
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s