Re: [OpenXPKI-users] Unable to approve CSR/CRR with digital signature

Marc Posch Wed, 30 Mar 2011 14:27:10 -0700

Hi,

I have done some debugging, commenting out the "unlink"-statements inCLI.pm so the files would stay under /var/tmp for analysis. I have comethat far:


OpenXPKI was started with:
openxpkictl start --debug OpenXPKI::Crypto::CLI:128

2011-03-30 23:09:23.996493 DEBUG:1 PID:12245OpenXPKI::Crypto::CLI::prepare (line 76): start2011-03-30 23:09:23.996627 DEBUG:2 PID:12245OpenXPKI::Crypto::CLI::prepare (line 78): handle parameter COMMAND2011-03-30 23:09:23.996904 DEBUG:4 PID:12245OpenXPKI::Crypto::CLI::prepare (line 93): prepared command:/usr/bin/openca-sv verify -in /var/tmp/openxpkiAhYhyo -data/var/tmp/openxpkigFRhUb 1>>/var/tmp/openxpki8dSKJh2>>/var/tmp/openxpkijzlYtt2011-03-30 23:09:23.997091 DEBUG:1 PID:12245OpenXPKI::Crypto::CLI::prepare (line 95): end2011-03-30 23:09:23.997246 DEBUG:1 PID:12245OpenXPKI::Crypto::CLI::execute (line 110): start2011-03-30 23:09:23.997382 DEBUG:2 PID:12245OpenXPKI::Crypto::CLI::execute (line 124): execute commands2011-03-30 23:09:23.997580 DEBUG:4 PID:12245OpenXPKI::Crypto::CLI::execute (line 127): command: /usr/bin/openca-svverify -in /var/tmp/openxpkiAhYhyo -data /var/tmp/openxpkigFRhUb1>>/var/tmp/openxpki8dSKJh 2>>/var/tmp/openxpkijzlYtt2011-03-30 23:09:24.095248 DEBUG:64 PID:12245OpenXPKI::Crypto::CLI::execute (line 181): CHILD_ERROR: 2562011-03-30 23:09:24.104578 DEBUG:1 PID:12245OpenXPKI::Crypto::CLI::cleanup (line 270): start2011-03-30 23:09:24.112553 DEBUG:1 PID:12245OpenXPKI::Crypto::CLI::cleanup (line 283): end


I also got hold of the input- and output files, they are attached.

The output openca-sv generates seems to be:
[Error]: Digest mismatch. Signature is wrong.

What can be wrong?

Regards,
Marc

On 30.03.2011 4:19, Marc Posch wrote:

Hi again,

I have worked through a "test plan" which I have set up for myself with
the default TESTDUMMYCA and got to the following point:

- Sign in as root and unlock CA key -> successful
- Issue CRL -> successful
- Request CA Operator Certificate using basic template -> successful
- Login as raop and approve CSR without signature -> successful
- Request RA Operator Certificate using basic template -> successful
- Login as root using external static mode and approve CSR without
signature -> successful
- Login as John Doe and request User Certificate using basic template ->
successful
- Login as raop with digital signature -> successful
- Approve CSR with digital signature -> error

I have already configured my trust_anchors in auth.xml,
workflow_validator_certificate_revocation_request.xml and
workflow_validator_certificate_signing_request.xml
to
I18N_OPENXPKI_DEPLOYMENT_TEST_DUMMY_CA.

Here is what the webinterface returns:
--------------------------------------------
Error

I18N_OPENXPKI_SERVER_WORKFLOW_VALIDATOR_APPROVALSIGNATURE_SIGNATURE_INVALID

Raw Error Data:

{
'LIST' => [
{
'LABEL' =>
'I18N_OPENXPKI_SERVER_WORKFLOW_VALIDATOR_APPROVALSIGNATURE_SIGNATURE_INVALID',

'PARAMS' => {}
}
],
'SERVICE_MSG' => 'ERROR'
}


Certificate Revocation Request: Approval

To approve this certificate revocation request, you can either approve
with out without signature. Please choose the appropriate button to
approve the certificate revocation request.
--------------------------------------------
I can still approve the CSR without signature after that. This is the
content of /var/log/openxpki.log during approval:

--------------------------------------------
2011/03/30 13:48:54 openxpki.system.DEBUG [OpenXPKI::Crypto::CLI
(/usr/lib/perl5/OpenXPKI/Crypto/CLI.pm:182); raop(RA Operator)@f644]
Exception: I18N_OPENXPKI_CRYPTO_CLI_EXECUTE_CHILD_ERROR; _
_SIGNAL__ => 0; __EXIT_CODE__ => 1
2011/03/30 13:48:54 openxpki.system.DEBUG [OpenXPKI::Crypto::CLI
(/usr/lib/perl5/OpenXPKI/Crypto/CLI.pm:182); raop(RA Operator)@f644]
Exception: I18N_OPENXPKI_CRYPTO_CLI_EXECUTE_CHILD_ERROR; _
_SIGNAL__ => 0; __EXIT_CODE__ => 1
2011/03/30 13:48:54 openxpki.system.DEBUG [OpenXPKI::Crypto::Toolkit
(/usr/lib/perl5/OpenXPKI/Crypto/Toolkit.pm:464); raop(RA Operator)@f644]
Exception: I18N_OPENXPKI_TOOLKIT_COMMAND_FAILED; _
_COMMAND__ => OpenXPKI::Crypto::Tool::PKCS7::Command::verify; __ERRVAL__
=> I18N_OPENXPKI_CRYPTO_CLI_EXECUTE_CHILD_ERROR; __SIGNAL__ => 0;
__EXIT_CODE__ => 1
2011/03/30 13:48:54 openxpki.system.DEBUG [OpenXPKI::Crypto::Toolkit
(/usr/lib/perl5/OpenXPKI/Crypto/Toolkit.pm:464); raop(RA Operator)@f644]
Exception: I18N_OPENXPKI_TOOLKIT_COMMAND_FAILED; _
_COMMAND__ => OpenXPKI::Crypto::Tool::PKCS7::Command::verify; __ERRVAL__
=> I18N_OPENXPKI_CRYPTO_CLI_EXECUTE_CHILD_ERROR; __SIGNAL__ => 0;
__EXIT_CODE__ => 1
2011/03/30 13:48:54 openxpki.system.WARN
[OpenXPKI::Server::Workflow::Validator::ApprovalSignature
(/usr/lib/perl5/OpenXPKI/Server/Workflow/Validator/ApprovalSignature.pm:159);
raop(RA Operato
r)@f644] Exception:
I18N_OPENXPKI_SERVER_WORKFLOW_VALIDATOR_APPROVALSIGNATURE_SIGNATURE_INVALID
2011/03/30 13:48:54 openxpki.system.WARN
[OpenXPKI::Server::Workflow::Validator::ApprovalSignature
(/usr/lib/perl5/OpenXPKI/Server/Workflow/Validator/ApprovalSignature.pm:159);
raop(RA Operato
r)@f644] Exception:
I18N_OPENXPKI_SERVER_WORKFLOW_VALIDATOR_APPROVALSIGNATURE_SIGNATURE_INVALID
2011/03/30 13:48:54 Workflow.ERROR Caught exception from action:
I18N_OPENXPKI_SERVER_WORKFLOW_VALIDATOR_APPROVALSIGNATURE_SIGNATURE_INVALID;
reset workflow to old state 'PENDING'
2011/03/30 13:48:54 Workflow.ERROR Caught exception from action:
I18N_OPENXPKI_SERVER_WORKFLOW_VALIDATOR_APPROVALSIGNATURE_SIGNATURE_INVALID;
reset workflow to old state 'PENDING'
--------------------------------------------

I will try to investigate a little bit more by activating debug logging...

Regards,
Marc

depth:0 serial:02DF687F2ADC4D88CAFF subject:UID=raop+CN=RA Operator,DC=Test 
Deployment,DC=OpenXPKI,DC=org

I approve the CRR for workflow 9727.
ID of the certificate to be revoked:
3bB6OOHm5m-EmKhpVN1UpGfJtDw
SHA1-Hash of the session ID:
4euGQYxdX7E0SCHx4Nn8jVcNHEs

[Error]: Digest mismatch. Signature is wrong.

------------------------------------------------------------------------------
Create and publish websites with WebMatrix
Use the most popular FREE web apps or write code yourself; 
WebMatrix provides all the features you need to develop and 
publish your website. http://p.sf.net/sfu/ms-webmatrix-sf

_______________________________________________
OpenXPKI-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openxpki-users

Re: [OpenXPKI-users] Unable to approve CSR/CRR with digital signature

Reply via email to