On Thu, 8 May 2025 09:51, Werner Koch said: > Please send me the PKCS7.p7b file again by private mail and gzip it > first to avoid any problems.
Thanks. That file is a certs-only CMS object. It is base64 encoded w/o
the header lines. After converting this to binary I get:
$ gpgsm -v --import ~/tmp/PKCS7_m.p7
[...]
gpgsm: certificate imported
gpgsm: certificate is good
gpgsm: certificate imported
gpgsm: certificate is good
gpgsm: certificate imported
gpgsm: certificate is good
gpgsm: certificate is good
gpgsm: certificate imported
gpgsm: no subject found in certificate
gpgsm: total number processed: 4
gpgsm: imported: 4
[GNUPG:] FAILURE gpgsm-exit 50331649
Thus all certificates where imported but due to a missing subject in of
of it, gpgsm returns with an error (the code is General Error). A gpgsm
-k gives (with some redaction):
S/N: 01
Issuer: /CN=AAA Certificate Services/O=Comodo CA
Limited/L=Salford/ST=Greater Manchester/C=GB
Subject: [Same as /CN=AAA Certificate Services/O=Comodo CA
Limited/L=Salford/ST=Greater Manchester/C=GB
S/N: 3972443AF922B751D7D36C10DD313595
(dec): 76359301477803385872276235234032301461
Issuer: /CN=AAA Certificate Services/O=Comodo CA
Limited/L=Salford/ST=Greater Manchester/C=GB
Subject: /CN=USERTrust RSA Certification Authority/O=The USERTRUST
Network/L=Jersey City/ST=New Jersey/C=US
S/N: 4D942C10D43BE09409C5812D3A2B064F
Issuer: /CN=USERTrust RSA Certification Authority/O=The USERTRUST
Network/L=Jersey City/ST=New Jersey/C=US
Subject: /CN=Sectigo RSA Client Authentication and Secure Email
CA/O=Sectigo Limited/L=Salford/ST=Greater Manchester/C=GB
ID: 0x520AB3F9
S/N: 00CDB882CF52A4258A4CB6FA03C415DDBD
Issuer: /CN=Sectigo RSA Client Authentication and Secure Email
CA/O=Sectigo Limited/L=Salford/ST=Greater Manchester/C=GB
Subject: [Error - No name]
aka: <mail address redacted - wk>
Because gpgsm does by default only detect armored and binary data you
need to tell it that the input is base64 only:
$ gpgsm -v --import --assume-base64 ~/tmp/PKCS7_m.p7b
That will yield the same result as my import from the binary version.
Takeaway is that we can handle an empty subject but that return an
error. I just fixed this for for master and 2.4.
See https://dev.gnupg.org/T7171
Auto detecting plain base64 will not be implemented (in your sample this
is just one long line).
Shalom-Salam,
Werner
--
The pioneers of a warless world are the youth that
refuse military service. - A. Einstein
openpgp-digital-signature.asc
Description: PGP signature
_______________________________________________ Gnupg-users mailing list Gnupg-users@gnupg.org https://lists.gnupg.org/mailman/listinfo/gnupg-users
