[tpm2] OpenSSL 3 and tpm2 provider...
Sievert, James <james.sievert at bsci.com> Tue, 26 Apr 2022 11:32:26 +0000
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | < <DS7PR03MB5576F012EB9AAE6CBBA10C919AFB9@DS7PR03MB5576.namprd03.prod.outlook.com>> |
Hi,
I'm using the following OpenSSL version under Ubuntu 22.04: OpenSSL 3.0.2 15 Mar 2022 (Library: OpenSSL 3.0.2 15 Mar 2022).
I have an EC public key certificate held persistently in a TPM 2.0, handle 0x01000013. I'm attempting the following:
$ openssl x509 -provider tpm2 -in handle:0x01000013 -noout -text
and finding that OpenSSL x509 is unable to load the public key:
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 9177472452311271732 (0x7f5cee922ff24934)
Signature Algorithm: ecdsa-with-SHA256
Issuer: CN = aaaa, OU = yyyy, O = zzzz
Validity
Not Before: Apr 25 16:43:35 2022 GMT
Not After : Dec 31 12:00:00 2045 GMT
Subject: CN = xxxx, OU = yyyy, O = zzzz
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Unable to load Public Key
402C48BB567F0000:error:03000072:digital envelope routines:X509_PUBKEY_get0:decode error:../crypto/x509/x_pubkey.c:458:
402C48BB567F0000:error:03000072:digital envelope routines:X509_PUBKEY_get0:decode error:../crypto/x509/x_pubkey.c:458:
X509v3 extensions:
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Authority Key Identifier:
B0:06:08:77:FC:C0:3B:0A:F5:8E:0C:B8:F1:DE:A9:55:8B:E5:F1:79
X509v3 Extended Key Usage:
TLS Web Client Authentication, Code Signing, E-mail Protection, TLS Web Server Authentication
X509v3 Subject Key Identifier:
4D:5D:71:84:B5:D9:7B:B1:11:52:58:BC:5E:BE:A8:0D:8C:AE:17:63
X509v3 Key Usage: critical
Digital Signature, Non Repudiation, Key Encipherment
Signature Algorithm: ecdsa-with-SHA256
Signature Value:
30:44:02:20:5b:ce:5e:3f:67:85:11:42:d5:5f:2a:ba:cd:12:
f2:e7:bd:0e:f5:9e:ae:d1:65:8d:9c:d3:dc:7c:8d:63:ec:07:
02:20:33:3f:b6:22:39:62:ff:3b:9f:21:eb:43:e1:9e:40:31:
39:fb:14:a8:1f:c9:33:48:18:99:33:dd:03:86:2c:0e
I am able to do this:
$ openssl x509 -provider tpm2 -in handle:0x01000013 | openssl x509 -in /dev/stdin -noout -text
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 9177472452311271732 (0x7f5cee922ff24934)
Signature Algorithm: ecdsa-with-SHA256
Issuer: CN = aaaa, OU = yyyy, O = zzzz
Validity
Not Before: Apr 25 16:43:35 2022 GMT
Not After : Dec 31 12:00:00 2045 GMT
Subject: CN = xxxx, OU = yyyy, O = zzzz
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (256 bit)
pub:
04:eb:d3:da:02:5a:43:4e:5c:1a:b5:09:e7:6a:8e:
1e:65:9f:eb:ab:35:d5:33:f9:1f:16:bf:d8:0d:c6:
f0:09:ae:10:60:3d:82:cf:46:29:a0:a9:24:47:dd:
e2:5a:ea:97:b6:c1:6a:fa:b2:8a:7c:30:36:36:1a:
8a:e2:91:62:4b
ASN1 OID: prime256v1
NIST CURVE: P-256
X509v3 extensions:
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Authority Key Identifier:
B0:06:08:77:FC:C0:3B:0A:F5:8E:0C:B8:F1:DE:A9:55:8B:E5:F1:79
X509v3 Extended Key Usage:
TLS Web Client Authentication, Code Signing, E-mail Protection, TLS Web Server Authentication
X509v3 Subject Key Identifier:
4D:5D:71:84:B5:D9:7B:B1:11:52:58:BC:5E:BE:A8:0D:8C:AE:17:63
X509v3 Key Usage: critical
Digital Signature, Non Repudiation, Key Encipherment
Signature Algorithm: ecdsa-with-SHA256
Signature Value:
30:44:02:20:5b:ce:5e:3f:67:85:11:42:d5:5f:2a:ba:cd:12:
f2:e7:bd:0e:f5:9e:ae:d1:65:8d:9c:d3:dc:7c:8d:63:ec:07:
02:20:33:3f:b6:22:39:62:ff:3b:9f:21:eb:43:e1:9e:40:31:
39:fb:14:a8:1f:c9:33:48:18:99:33:dd:03:86:2c:0e
Any help would be appreciated.
Thanks.
attachment.htm
(text/html, 18.6 KB)
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’m using the following OpenSSL version under Ubuntu 22.04: OpenSSL 3.0.2 15 Mar 2022 (Library: OpenSSL 3.0.2 15 Mar 2022).<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I have an EC public key certificate held persistently in a TPM 2.0, handle 0x01000013. I’m attempting the following:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New"">$ openssl x509 -provider tpm2 -in handle:0x01000013 -noout -text<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">and finding that OpenSSL x509 is unable to load the public key:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New"">Certificate:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Data:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Version: 3 (0x2)<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Serial Number: 9177472452311271732 (0x7f5cee922ff24934)<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Signature Algorithm: ecdsa-with-SHA256<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Issuer: CN = aaaa, OU = yyyy, O = zzzz<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Validity<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Not Before: Apr 25 16:43:35 2022 GMT<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Not After : Dec 31 12:00:00 2045 GMT<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Subject: CN = xxxx, OU = yyyy, O = zzzz<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Subject Public Key Info:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Public Key Algorithm: id-ecPublicKey<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Unable to load Public Key<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New"">402C48BB567F0000:error:03000072:digital envelope routines:X509_PUBKEY_get0:decode error:../crypto/x509/x_pubkey.c:458:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New"">402C48BB567F0000:error:03000072:digital envelope routines:X509_PUBKEY_get0:decode error:../crypto/x509/x_pubkey.c:458:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> X509v3 extensions:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> X509v3 Basic Constraints: critical<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> CA:FALSE<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> X509v3 Authority Key Identifier:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> B0:06:08:77:FC:C0:3B:0A:F5:8E:0C:B8:F1:DE:A9:55:8B:E5:F1:79<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> X509v3 Extended Key Usage:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> TLS Web Client Authentication, Code Signing, E-mail Protection, TLS Web Server Authentication<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> X509v3 Subject Key Identifier:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> 4D:5D:71:84:B5:D9:7B:B1:11:52:58:BC:5E:BE:A8:0D:8C:AE:17:63<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> X509v3 Key Usage: critical<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Digital Signature, Non Repudiation, Key Encipherment<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Signature Algorithm: ecdsa-with-SHA256<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Signature Value:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> 30:44:02:20:5b:ce:5e:3f:67:85:11:42:d5:5f:2a:ba:cd:12:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> f2:e7:bd:0e:f5:9e:ae:d1:65:8d:9c:d3:dc:7c:8d:63:ec:07:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> 02:20:33:3f:b6:22:39:62:ff:3b:9f:21:eb:43:e1:9e:40:31:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> 39:fb:14:a8:1f:c9:33:48:18:99:33:dd:03:86:2c:0e<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I am able to do this:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New"">$ openssl x509 -provider tpm2 -in handle:0x01000013 | openssl x509 -in /dev/stdin -noout -text<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New"">Certificate:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Data:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Version: 3 (0x2)<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Serial Number: 9177472452311271732 (0x7f5cee922ff24934)<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Signature Algorithm: ecdsa-with-SHA256<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Issuer: CN = aaaa, OU = yyyy, O = zzzz<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Validity<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Not Before: Apr 25 16:43:35 2022 GMT<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Not After : Dec 31 12:00:00 2045 GMT<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Subject: CN = xxxx, OU = yyyy, O = zzzz<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Subject Public Key Info:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Public Key Algorithm: id-ecPublicKey<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Public-Key: (256 bit)<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> pub:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> 04:eb:d3:da:02:5a:43:4e:5c:1a:b5:09:e7:6a:8e:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> 1e:65:9f:eb:ab:35:d5:33:f9:1f:16:bf:d8:0d:c6:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> f0:09:ae:10:60:3d:82:cf:46:29:a0:a9:24:47:dd:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> e2:5a:ea:97:b6:c1:6a:fa:b2:8a:7c:30:36:36:1a:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> 8a:e2:91:62:4b<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> ASN1 OID: prime256v1<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> NIST CURVE: P-256<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> X509v3 extensions:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> X509v3 Basic Constraints: critical<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> CA:FALSE<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> X509v3 Authority Key Identifier:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> B0:06:08:77:FC:C0:3B:0A:F5:8E:0C:B8:F1:DE:A9:55:8B:E5:F1:79<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> X509v3 Extended Key Usage:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> TLS Web Client Authentication, Code Signing, E-mail Protection, TLS Web Server Authentication<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> X509v3 Subject Key Identifier:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> 4D:5D:71:84:B5:D9:7B:B1:11:52:58:BC:5E:BE:A8:0D:8C:AE:17:63<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> X509v3 Key Usage: critical<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Digital Signature, Non Repudiation, Key Encipherment<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Signature Algorithm: ecdsa-with-SHA256<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> Signature Value:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> 30:44:02:20:5b:ce:5e:3f:67:85:11:42:d5:5f:2a:ba:cd:12:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> f2:e7:bd:0e:f5:9e:ae:d1:65:8d:9c:d3:dc:7c:8d:63:ec:07:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> 02:20:33:3f:b6:22:39:62:ff:3b:9f:21:eb:43:e1:9e:40:31:<o:p></o:p></span></p>
<p class="MsoNormal" style="text-indent:.5in"><span style="font-size:8.0pt;font-family:"Courier New""> 39:fb:14:a8:1f:c9:33:48:18:99:33:dd:03:86:2c:0e</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Any help would be appreciated.<o:p></o:p></p>
<p class="MsoNormal">Thanks.<o:p></o:p></p>
</div>
</body>
</html>