<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div style="font-family: Verdana;font-size: 12.0px;">
<div>Hello,</div>
<div> </div>
<div>I think there is something broken with verifying the Private Key with "openssl rsa -check" like it was described in <a href="https://blog.hboeck.de/archives/888-How-I-tricked-Symantec-with-a-Fake-Private-Key.html" target="_blank">https://blog.hboeck.de/archives/888-How-I-tricked-Symantec-with-a-Fake-Private-Key.html</a></div>
<div> </div>
<div>I tried to implement better checking in a script that tells me if a key matches a certificate or certificate request.</div>
<div> </div>
<div>To reproduce, get the fake private key from <a href="https://github.com/hannob/tlshelpers/blob/master/examples/symantec.key" target="_blank">https://github.com/hannob/tlshelpers/blob/master/examples/symantec.key</a></div>
<div> </div>
<div>Verify the key with openssl 1.0.1e-fips or 1.0.2h:</div>
<div>$OPENSSL rsa -in symantec-broken.key -check -noout<br/>
RSA key error: n does not equal p q</div>
<div> </div>
<div>Verify the key with openssl 1.1.0c or 1.1.0f (gives no output)</div>
<div>$OPENSSL rsa -in symantec-broken.key -check -noout</div>
<div> </div>
<div> </div>
<div>I would expect 1.1.0 to report the faked key in some way.</div>
<div>Even the returnvalue for openssl returns with a 0 no matter if used a legimate key or a faked key.</div>
<div> </div>
<div> </div>
<div> </div>
<div>Kind Regards,</div>
<div>Georg</div>
</div></div></body></html>