gh-120762: fix make_ssl_certs.py - no SKID or AKID in CSR#120764
Closed
Uh oh!
There was an error while loading. Please reload this page.
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
ContributorAuthor
AdamWill commented Jun 19, 2024
NOTE: I am not 100% confident in this fix, it should be reviewed by someone who knows what they're doing. It seems to work, and examining the signed certificate it produces shows the intended stuff seems to be there, but still not 100% sure. |
AdamWillforce-pushed the make-ssl-certs-csr-fix branch from 3ba27a1 to 2432dcfCompare2 tasks
Per openssl/openssl#22966 , it is not valid to have a subjectKeyIdentifier or an authorityKeyIdentifier in a CSR. Up until openssl 3.2.0 this happened not to cause an error, but since a bugfix in 3.2.0 it does: 80D2CF679F7F0000:error:11000079:X509 V3 routines:v2i_AUTHORITY_KEYID:no issuer certificate:crypto/x509/v3_akid.c:156: To fix this, when generating a signed certificate, let's always use req_x509_extensions_simple for the CSR, and use the specified req (usually req_x509_extensions_full) only when asking the CA to process the CSR and produce the final signed certificate. Signed-off-by: Adam Williamson <awilliam@redhat.com>
AdamWillforce-pushed the make-ssl-certs-csr-fix branch from 2432dcf to 3027a5cCompare
Member
encukou commented Oct 7, 2024
Thank you for the report and investigation! |
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Per openssl/openssl#22966 , it is not valid to have a subjectKeyIdentifier or an authorityKeyIdentifier in a CSR. Up until openssl 3.2.0 this happened not to cause an error, but since a bugfix in 3.2.0 it does:
80D2CF679F7F0000:error:11000079:X509 V3 routines:v2i_AUTHORITY_KEYID:no issuer certificate:crypto/x509/v3_akid.c:156:
To fix this, when generating a signed certificate, let's always use req_x509_extensions_simple for the CSR, and use the specified req (usually req_x509_extensions_full) only when asking the CA to process the CSR and produce the final signed certificate.