LibreSSL 3.7.x doesn't implement 'openssl x509 -force_pubkey' #842
Labels
Comments
|
It hasn't come up before. It's easy enough to add, the below was only lightly tested and applies to LibreSSL 3.7.2. diff --git a/src/usr.bin/openssl/x509.c b/src/usr.bin/openssl/x509.c
index 66cad3ab2..e51cfd296 100644
--- apps/openssl/x509.c
+++ apps/openssl/x509.c
@@ -113,6 +113,7 @@ static struct {
char *extfile;
char *extsect;
int fingerprint;
+ char *force_pubkey;
char *infile;
int informat;
int issuer;
@@ -467,6 +468,12 @@ static const struct option x509_options[] = {
.opt.order = &cfg.fingerprint,
.order = &cfg.num,
},
+ {
+ .name = "force_pubkey",
+ .desc = "Force the key to put inside the certificate",
+ .type = OPTION_ARG,
+ .opt.arg = &cfg.force_pubkey,
+ },
{
.name = "hash",
.desc = "Synonym for -subject_hash",
@@ -725,7 +732,7 @@ x509_main(int argc, char **argv)
int ret = 1;
X509_REQ *req = NULL;
X509 *x = NULL, *xca = NULL;
- EVP_PKEY *Upkey = NULL, *CApkey = NULL;
+ EVP_PKEY *Fpkey = NULL, *Upkey = NULL, *CApkey = NULL;
int i;
BIO *out = NULL;
BIO *STDout = NULL;
@@ -814,6 +821,11 @@ x509_main(int argc, char **argv)
goto end;
}
}
+ if (cfg.force_pubkey != NULL) {
+ if ((Fpkey = load_pubkey(bio_err, cfg.force_pubkey,
+ cfg.keyformat, 0, NULL, "Forced key")) == NULL)
+ goto end;
+ }
if (cfg.reqfile) {
EVP_PKEY *pkey;
BIO *in;
@@ -890,12 +902,12 @@ x509_main(int argc, char **argv)
NULL) == NULL)
goto end;
- if ((pkey = X509_REQ_get0_pubkey(req)) == NULL)
+ if ((pkey = Fpkey) == NULL)
+ pkey = X509_REQ_get0_pubkey(req);
+ if (pkey == NULL)
goto end;
- if (!X509_set_pubkey(x, pkey)) {
- EVP_PKEY_free(pkey);
+ if (!X509_set_pubkey(x, pkey))
goto end;
- }
} else {
x = load_cert(bio_err, cfg.infile, cfg.informat,
NULL, "Certificate");
@@ -1321,6 +1333,7 @@ x509_main(int argc, char **argv)
X509_REQ_free(req);
X509_free(x);
X509_free(xca);
+ EVP_PKEY_free(Fpkey);
EVP_PKEY_free(Upkey);
EVP_PKEY_free(CApkey);
sk_OPENSSL_STRING_free(cfg.sigopts); |
|
I tested the patch, but the tests still fail to verify the intermediate certificate. I attached the full |
|
This has been available since openbsd/src@0293fcf There may still be behavior differences to openssl with what goes to stdout and stderr which might be the reason why the tests you tried still fail. I think that's an independent issue that should be raised and fixed separately. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
When tpm2-tss has been configured with
--enable-self-generated-certificatemany tests will fail because thecreate_ca.shscript usesopenssl x509 -force_pubkeywhich is not implemented in LibreSSL.https://github.com/tpm2-software/tpm2-tss/blob/3d3c9a81db1354fe75dd27f5a87551c101034b0d/script/ekca/create_ca.sh#L163
https://github.com/tpm2-software/tpm2-tss/blob/3d3c9a81db1354fe75dd27f5a87551c101034b0d/script/ekca/create_ca.sh#L198
The script will succeed if the
-force_pubkeyargument is removed, but then the same tests will still fail. Perhaps its actually important in this case?The OpenSSL documentation shows:
https://www.openssl.org/docs/man1.1.1/man1/x509.html
I made WIP upstream PR here. tpm2-software/tpm2-tss#2380
The text was updated successfully, but these errors were encountered: