Jira (PUP-1387) CA generates subjectKeyIdentifier from issuer cert instead of cert itself

[Joshua Cooper (JIRA)]

Title: Message Title

Joshua Cooper commented on an issue   Re: CA generates subjectKeyIdentifier from issuer cert instead of cert itself In 3.4.2, created a new puppet master: 0 ~/work/puppet (3.4.2) $ be puppet master --no-daemonize --debug ... Ctrl-C Note puppetmaster and CA certs have the same subjectKeyIdentifier: 0 ~/work/puppet (3.4.2) $ openssl x509 -in ~/.puppet/ssl/certs/ca.pem -noout -text | grep -C 1 'Subject Key Identifier' CA:TRUE X509v3 Subject Key Identifier: AC:D5:A6:5F:DA:73:48:94:58:C5:B7:78:0E:4B:39:8D:12:2A:60:A0 0 ~/work/puppet (3.4.2) $ openssl x509 -in ~/.puppet/ssl/certs/arcturus.local.pem -noout -text | grep -C 1 'Subject Key Identifier' CA:FALSE X509v3 Subject Key Identifier: AC:D5:A6:5F:DA:73:48:94:58:C5:B7:78:0E:4B:39:8D:12:2A:60:A0 Updated to master (8f43a9f161f), regenerated certs, and subjectKeyIdentifiers are different as expected: 0 ~/work/puppet (master) $ openssl x509 -in ~/.puppet/ssl/certs/arcturus.local.pem -noout -text | grep -C 1 'Subject Key Identifier' CA:FALSE X509v3 Subject Key Identifier: 23:BF:A6:A7:9A:3A:7B:79:C5:A1:C7:44:03:E7:6A:DB:07:B8:A3:54 0 ~/work/puppet (master) $ openssl x509 -in ~/.puppet/ssl/certs/ca.pem -noout -text | grep -C 1 'Subject Key Identifier' CA:TRUE X509v3 Subject Key Identifier: 0C:6E:77:FC:66:AB:BA:D6:69:5B:F2:C5:E6:2F:B5:2F:16:F1:22:BA To verify that the subject key identifier is actually a cryptographic hash of the subject's public key, I followed http://certificateerror.blogspot.com/2011/02/how-to-validate-subject-key-identifier.html. The tricky part is that we have to extract the ASN.1 bit string: $ openssl x509 -in ~/.puppet/ssl/certs/arcturus.local.pem -noout -pubkey -noout | openssl asn1parse -strparse 19 -out pub.der $ openssl dgst -sha1 -c pub.der SHA1(pub.der)= 23:bf:a6:a7:9a:3a:7b:79:c5:a1:c7:44:03:e7:6a:db:07:b8:a3:54 And note that the hash matches the puppet master's subjectKeyIdentifier (23:BF:A6:A7:9A:3A:7B:79:C5:A1:C7:44:03:E7:6A:DB:07:B8:A3:54) and not the issuer's key. Add Comment   Puppet / PUP-1387 CA generates subjectKeyIdentifier from issuer cert instead of cert itself This regressed in commit 94345ebac6d79a890efc5f49e136c4f76ddda3ef This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/groups/opt_out.