Re: [OpenCA-Devel] Re: openca-verify

alexandru matei Tue, 09 Apr 2002 04:55:00 -0700

I think we-re getting in some problems with IE signatures (or my IE is not
configured corectly). I will attach some files. Here are some explanations:
18570.sig - signature with IE
18570.1.sig - signature with openca-sign
s11- binary from 18570.sig
s22- binary from 18570.1.sig
cacert.pem, key - CA files
alex.p12 - test cert
All files with password - the password is "password"
If you taka a look you can see that s22 and s11 differ consistently. I
presume that IE is signing a text in wich the letters are formatted
differently???. But anyhow, I don't know the way out of this.
I'll test the new OpenCA::PKCS7 a bit later.



Alex

Michael Bell wrote:

> alexandru matei schrieb:
> >
> > I'm having trouble with openca-verify on IE signatures (IE certificate
> > is 1024 bit RSA).
> > In openca-verify with no_chain I obtain:
> >  ./openca-verify -in 17924.sig -data 17924.txt -no_chain  -verbose
> > Signature Informations (PKCS#7):
> >     Depth: 0
> >         Serial Number: 0A
> >         Subject: /SN=0A/CN=alexandru matei/OU=Internet/O=My Org/C=RO
> > Verify Return: 0
> >     Signed Attributes:
> > Segmentation fault
>
> Looks like the IE don't attach the CA-cert to the signature.
>
> > ./openca-verify -in 17924.sig -data 17924.txt -cf
> > /usr/local/openca_mysql_ra/OpenCA/var/crypto/cacerts/cacert.pem
> > -verbose
> > Signature Informations (PKCS#7):
> >     Depth: 1
> >         Serial Number: 00
> >         Subject: [EMAIL PROTECTED]/CN=PKI/OU=PKI/O=My
> > Org/C=RO
> > Verify Return: 1
> >     Signed Attributes:
> >     Depth: 0
> >         Serial Number: 0A
> >         Subject: /SN=0A/CN=alexandru matei/OU=Internet/O=My Org/C=RO
> > Verify Return: 1
> >     Signed Attributes:
> > 18330:error:04077068:rsa routines:RSA_verify:bad
> > signature:rsa_sign.c:217:
> > 18330:error:21071069:PKCS7 routines:PKCS7_signatureVerify:signature
> > failure:pk7_doit.c:840:
>
> Did you have a complete chain-directory? Is cacert.pem a root-CA?
> Perhaps the verification fails because openca-verify cannot find the
> next CA-cert. Can you send me the signature and all certificates?
>
> Did you removed the carriage returns?
>
> Michael
> --
> -------------------------------------------------------------------
> Michael Bell                   Email (private): [EMAIL PROTECTED]
> Rechenzentrum - Datacenter     Email:  [EMAIL PROTECTED]
> Humboldt-University of Berlin  Tel.: +49 (0)30-2093 2482
> Unter den Linden 6             Fax:  +49 (0)30-2093 2959
> 10099 Berlin
> Germany                                       http://www.openca.org
>
> _______________________________________________
> OpenCA-Devel mailing list
> [EMAIL PROTECTED]
> https://lists.sourceforge.net/lists/listinfo/openca-devel

s22
Description: Binary data

18570.sig
Description: application/unknown-content-type-pgp

You are going to sign this simple text. Be sure
Javascript is enabled and your certificate gets
correctly verified in your browser.

s11
Description: Binary data

18570.1.sig
Description: application/unknown-content-type-pgp

alex.p12
Description: application/pkcs12

Re: [OpenCA-Devel] Re: openca-verify

Reply via email to