<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Bonjour,
<div class=""><br class="">
</div>
<div class="">
<div>
<blockquote type="cite" class="">
<div class="">Le 11 févr. 2016 à 20:25, Blumenthal, Uri - 0553 - MITLL <<a href="mailto:uri@ll.mit.edu" class="">uri@ll.mit.edu</a>> a écrit :</div>
<br class="Apple-interchange-newline">
<div class="">
<blockquote type="cite" class="">On Thu, Feb 11, 2016 at 12:47 AM, Stephen Henson via RT <<a href="mailto:rt@openssl.org" class="">rt@openssl.org</a>><br class="">
wrote:<br class="">
<blockquote type="cite" class="">On Wed Feb 10 21:59:12 2016, <a href="mailto:bcristi@gmail.com" class="">
bcristi@gmail.com</a> wrote:<br class="">
As the error is suggesting it doesn't like the serialNumber in the<br class="">
certificate.<br class="">
If you check it with asn1parse it says "BAD INTEGER". Using dumpasn1 you<br class="">
get:<br class="">
<br class="">
13 20: INTEGER 00 59 DF E1 E2 94 81 88 77 C5 3E E2 D3 2F 2B A2 BB 5F EB<br class="">
DA<br class="">
: Error: Integer '00 59 ...' has non-DER encoding.<br class="">
</blockquote>
</blockquote>
^^^^^<br class="">
Probably correct IN THIS ONE CASE, because Most Significant Bit is zero<br class="">
even without the leading zero byte. See below.<br class="">
<br class="">
<blockquote type="cite" class="">
<blockquote type="cite" class="">The problem is that is an invalid encoding. An ASN.1 INTEGER cannot<br class="">
contain<br class="">
leading zeroes. <br class="">
</blockquote>
</blockquote>
<br class="">
I’m pretty sure this is not correct. It’s been a while since I touched<br class="">
ASN.1, but I had quite a bit of experience with it back when. SO first of<br class="">
all, could you please cite your (authoritative) sources stating that an<br class="">
ASN.1 DER_encoded INTEGER cannot have leading zero. Here’s what others<br class="">
<<a href="http://stackoverflow.com/questions/5974633/asn-1-der-formatted-private-key" class="">http://stackoverflow.com/questions/5974633/asn-1-der-formatted-private-key</a><br class="">
<blockquote type="cite" class="">had to say about this:<br class="">
</blockquote>
</div>
</blockquote>
<div><br class="">
</div>
<div>X.690 edition 2015/08 is freely downloadable from the ITU-T website.</div>
<div>Section 8.3 describes how an INTEGER is to be encoded in BER.</div>
<div>8.3.2 says:</div>
</div>
</div>
<blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" class="">
<div class="">
<div>
<div>
<div class="page" title="Page 15">
<div class="layoutArea">
<div class="column">
<p class=""><span style="font-size: 10.000000pt; font-family: 'Times New Roman'" class="">If the contents octets of an integer value encoding consist of more than one octet, then the bits of the first octet and bit 8 of the second octet:</span></p>
</div>
</div>
</div>
</div>
</div>
</div>
<div class="">
<div>
<div>
<div class="page" title="Page 15">
<div class="layoutArea">
<div class="column">
<div class="page" title="Page 15">
<div class="layoutArea">
<div class="column">
<p class=""><span style="font-size: 10.000000pt; font-family: 'Times New Roman'" class="">a) </span><span style="font-family: 'Times New Roman'; font-size: 13px;" class="">shall not all be ones; and</span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div class="">
<div>
<div>
<div class="page" title="Page 15">
<div class="layoutArea">
<div class="column">
<div class="page" title="Page 15">
<div class="layoutArea">
<div class="column">
<p class=""><span style="font-size: 10.000000pt; font-family: 'Times New Roman'" class="">b) </span><span style="font-family: 'Times New Roman'; font-size: 13px;" class="">shall not all be zero.</span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div class="">
<div>
<div>
<div class="page" title="Page 15">
<div class="layoutArea">
<div class="column">
<p class=""><span style="font-size: 9pt; font-family: 'Times New Roman';" class="">NOTE
</span><span style="font-size: 9pt; font-family: 'Times New Roman';" class="">– </span>
<span style="font-size: 9pt; font-family: 'Times New Roman';" class="">These rules ensure that an integer value is always encoded in the smallest possible number of octets.</span><span style="font-size: 10.000000pt; font-family: 'Times New Roman'" class=""> </span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<div class="">
<div>
<div>In this specific example (00 59 …), the bits of the first octets and bit 8 of the second octet are all zero. This is invalid.</div>
<div><br class="">
</div>
<div>There is no additional rule for DER on INTEGERs.</div>
</div>
</div>
<div class=""><br class="">
</div>
<div class="">
<div class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class="">Cordialement,</div>
<div class="">Erwann Abalea</div>
<div class=""><br class="">
</div>
</div>
</div>
</div>
</body>
</html>