[openssl-users] Openssl failed to decrypt certificate without \r\n

[Zhang, Lily (USD)]

I used OpenSSL 1.0.2h

OpenSSL> version

OpenSSL 1.0.2h  3 May 2016



Thanks

Lily

From: openssl-users [mailto:openssl-users-bounces at openssl.org] On Behalf Of Benjamin Kaduk via openssl-users
Sent: Monday, September 18, 2017 8:24 PM
To: openssl-users at openssl.org; Viktor Dukhovni
Subject: Re: [openssl-users] Openssl failed to decrypt certificate without \r\n

On 09/18/2017 12:59 AM, Viktor Dukhovni wrote:




On Sep 17, 2017, at 10:23 PM, Zhang, Lily (USD) <Lily.Zhang at dell.com><mailto:Lily.Zhang at dell.com> wrote:



Would you help me to take a look this certificate issue?

In order to send out the file, I added ".txt" in the file name. Please remove it before test it.



Leaf_no_rn.cer doesn't have \r\n in the BASE64 string, it can't be parsed by openssl.

Leaf_with_rn.cer is the same as Leaf_no_rn.cer, but it has \r\n in BASE64 string.

Both the attached two certificates can be parsed by Windows.



This is expected, the OpenSSL PEM file reader does not support

input lines with IIRC more than 64 bytes.  PEM files are not

supposed to have longer lines.



The current code in master should not have a particular limit on line lengths for *certificates* -- in test/recipes/04-test_pem_data we have files with 1025 characters on a line, and only use a 256-byte buffer when reading.  The PEM format does specify a 64-(base64-)characters-per-line limit when the additional PEM encryption/etc. features are used, but certificates do not use that feature and do not have a line length restriction.  Perhaps Lily should specify what version of OpenSSL is in use.

-Ben

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mta.openssl.org/pipermail/openssl-users/attachments/20170918/7d7a9310/attachment-0001.html>