<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<meta content="text/html; charset=UTF-8">
<style type="text/css" style="">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div id="x_divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Arial,Helvetica,sans-serif">
<p>thanks for explanation.</p>
<p><br>
</p>
<p>But why did Windows Cert Manager and Firefox Cert Manager show <b><font size="2"><span style="font-size:10pt">00BEED73EE
</span></font></b>as serial number instead of <b><font size="2"><span style="font-size:10pt">BEED73EE</span></font>
</b>(which openssl shows)?</p>
<p><font size="2"><span style="font-size:10pt"></span></font><br>
</p>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>Von:</b> openssl-users <openssl-users-bounces@openssl.org> im Auftrag von Viktor Dukhovni <openssl-users@dukhovni.org><br>
<b>Gesendet:</b> Samstag, 28. Januar 2017 17:00:53<br>
<b>An:</b> openssl-users@openssl.org<br>
<b>Betreff:</b> Re: [openssl-users] Leading Zeros in ASN1_INTEGER?</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText"><br>
> On Jan 28, 2017, at 10:01 AM, Matthias Ballreich <matthias.ballreich@outlook.de> wrote:<br>
> <br>
> is it normal that OpenSSL removes the leading Zeros in an ASN1_INTEGER?<br>
> I tried to read the Certificate Serial and the Certificate Serial in the<br>
> AuthorityKeyID-Extension with C++, which works very well, but i noticed<br>
> that OpenSSL removes the leading Zeros on it.<br>
> <br>
> The real ASN1-Value is: 00BEED73EE for example, but i got only BEED73EE.<br>
> If i view the Certificate inside Microsoft Cert Tool (Certmgr.exe) the<br>
> leading Zeros are listed there. Same on Firefox, if i Import and view<br>
> the Certificate there. So is this the correct way of handling inside<br>
> OpenSSL or is it a bug or?<br>
<br>
Integers don't have leading zeros. Octet strings representing integers<br>
(in non-DER form) might have leading zeros, but you should not confuse<br>
the data type with its representation. OpenSSL outputs the correct DER<br>
form of the serial *number* in certificates.<br>
<br>
Leading zeros are needed in the DER representation of positive integers<br>
whose most significant nibble is in the range from 8 to F. Otherwise<br>
the leading bit would cause the integer to be interpreted as negative.<br>
<br>
-- <br>
Viktor.<br>
<br>
-- <br>
openssl-users mailing list<br>
To unsubscribe: <a href="https://mta.openssl.org/mailman/listinfo/openssl-users">
https://mta.openssl.org/mailman/listinfo/openssl-users</a><br>
</div>
</span></font>
</body>
</html>