creating certificate by code / problems to load via openssl x509 / pem format

[Andreas Tengicki]

Hello,

your first help in this project, helps much, but now some weeks later,
there is a new problem, and I cannot find any tipps via google.

For all the coding a have looked into the openssl examples.

I create a private key per code, the "openssl rsa -in
test_privatekey.pem -check" is fine

I create a certificate request per code, "openssl req -text -noout
-verify -in test_request.pem" is fine

I create a certifcate via this reqeust and store it with
"PEM_write_bio_X509(out, crt);" like the others. (some more code below)

Perhaps there is something wrong, but to detect this, I will use the
validation, but it cannot load the certificate to validate it:

>> openssl x509 -in test_certificate.pem -text
unable to load certificate
140180222239872:error:0D07209B:asn1 encoding
routines:ASN1_get_object:too long:../crypto/asn1/asn1_lib.c:91:
140180222239872:error:0D068066:asn1 encoding
routines:asn1_check_tlen:bad object header:../crypto/asn1/tasn_dec.c:1118:
140180222239872:error:0D07803A:asn1 encoding
routines:asn1_item_embed_d2i:nested asn1
error:../crypto/asn1/tasn_dec.c:190:Type=ASN1_TIME
140180222239872:error:0D08303A:asn1 encoding
routines:asn1_template_noexp_d2i:nested asn1
error:../crypto/asn1/tasn_dec.c:627:Field=notBefore, Type=X509_VAL
140180222239872:error:0D08303A:asn1 encoding
routines:asn1_template_noexp_d2i:nested asn1
error:../crypto/asn1/tasn_dec.c:627:Field=validity, Type=X509_CINF
140180222239872:error:0D08303A:asn1 encoding
routines:asn1_template_noexp_d2i:nested asn1
error:../crypto/asn1/tasn_dec.c:627:Field=cert_info, Type=X509
140180222239872:error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1
lib:../crypto/pem/pem_oth.c:33:

Thanks for any help.

Best regards

  Andreas

----

ErrorHandling should be added in a second step, first debug outputs (I
have deleted for here) says everything is created

X509* certificate_create(const X509_REQ* req)
{
  //openssl x509 -req -days 365 -sha256 -in server.csr -CA ca.crt -CAkey
ca.key -CAcreateserial -out server.crt

  if ((crt = X509_new()) == NULL);
  //xca = load_cert(CAfile, CAformat, "CA Certificate");
  BIO *bio = NULL;
  bio = BIO_new_file(CAfile, "r");
  xca = PEM_read_bio_X509_AUX(bio, NULL, NULL, NULL);
  BIO_free(bio);

  upkey = X509_get0_pubkey(xca);

  char CAkeyile[] = "ca.key";
  int CAkeyformat = 5; //FORMAT_PEM
  char passin[] = "xyz";

  ENGINE *e = NULL;
  EVP_PKEY * CApkey = NULL;
  //CApkey = load_key(CAkeyfile, CAkeyformat, 0, passin, e, "CA Private
Key");
  bio = BIO_new_file(CAkeyile, "r");
  CApkey = PEM_read_bio_PrivateKey(bio, NULL, NULL, passin);
  BIO_free(bio);

  EVP_PKEY_copy_parameters(upkey, CApkey);

  X509_STORE *ctx = NULL;
  ctx = X509_STORE_new();

  X509_STORE_CTX *xsc = NULL;
  xsc = X509_STORE_CTX_new();
  if (xsc == NULL || !X509_STORE_CTX_init(xsc, ctx, crt, NULL));

  ASN1_INTEGER *serialno = NULL;
  serialno = ASN1_INTEGER_new();
  BIGNUM *btmp = NULL;
  btmp = BN_new();

  # define SERIAL_RAND_BITS        159
  if (!BN_rand(btmp, SERIAL_RAND_BITS, BN_RAND_TOP_ANY,
BN_RAND_BOTTOM_ANY));
  if (!BN_to_ASN1_INTEGER(btmp, serialno));
  BN_free(btmp);

  X509_STORE_CTX_set_cert(xsc, crt);
  X509_STORE_CTX_set_flags(xsc, X509_V_FLAG_CHECK_SS_SIGNATURE);

  if (!X509_check_private_key(xca, CApkey)) ;

  if (!X509_set_issuer_name(crt, X509_get_subject_name(xca)));
  if (!X509_set_serialNumber(crt, serialno));

  int days = 365;
  if (X509_time_adj_ex(X509_getm_notAfter(crt), days, 0, NULL) == NULL);

  const char digestname[] = "sha256";
  const EVP_MD* md = EVP_get_digestbyname(digestname);
  EVP_MD_CTX *mctx = EVP_MD_CTX_new();
  EVP_PKEY_CTX *pkctx = NULL;
  EVP_DigestSignInit(mctx, &pkctx, md, NULL, CApkey);  //ist CApkey hier
der richtige private Key? sollte eigentlich
  int rv = (X509_sign_ctx(crt, mctx) > 0);
  EVP_MD_CTX_free(mctx);

  BIO *out = NULL;
  out = BIO_new_file("test_certificate.pem", "w");
  PEM_write_bio_X509(out, crt);
  BIO_free_all(out);

  ...some more frees ...
  return crt;
}

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mta.openssl.org/pipermail/openssl-users/attachments/20200709/c0910ab9/attachment-0001.html>