owner certificate should be CMS struct #88
Assignees
Comments
|
Hi Ashwin, could you clarify which elements are missing from the Ownership Certificate? Also please note the generate.go file is only used to generate testdata. Real Ownership Certificates and Vouchers are expected to contain the full structure. |
|
Hi Thanks for the update. I used the following python code to get the CMS data and X509 data import base64
import os
from asn1crypto import cms
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.serialization import pkcs7
from cryptography.x509 import load_pem_x509_certificate
home_dir = os.getenv("HOME")
dir_path = f"{home_dir}/tmp/ws/bootz/testdata"
oc_pem_file = "oc_pub.pem"
ov_pem_file = "ov_123A.txt"
def print_pkcs7_cert_chain_data(p7data_bytes):
cert_chain = pkcs7.load_der_pkcs7_certificates(p7data_bytes)
print(f"# of certs found: {len(cert_chain)}")
# for cert in cert_chain:
# print_cert_data(cert)
def print_cert_data(cert):
print(cert)
print(f"issuer: {cert.issuer}")
print(f"subject: {cert.subject}")
print(f"valid from: {cert.not_valid_before}")
print(f"valid till: {cert.not_valid_after}")
def get_pkcs7_content(file_name: str):
print("=======================================================================")
print(f"attempting to parse the content of file {file_name} as CMS struct")
try:
file_path = f"{dir_path}/{file_name}"
p7data_str = open(file_path, "r").read()
p7data_str = p7data_str.replace("-----BEGIN CERTIFICATE-----", "")
p7data_str = p7data_str.replace("-----END CERTIFICATE-----", "")
p7data_bytes = base64.b64decode(p7data_str)
print_pkcs7_cert_chain_data(p7data_bytes)
ci = cms.ContentInfo.load(p7data_bytes)
print(f"CMS ContentInfo Object: {ci}")
print(f"CMS Content Type: {ci['content_type']}")
except Exception as e:
print(e)
def get_x509_content(file_name: str):
print("-----------------------------------------------------------------------")
try:
print(f"attempting to parse the content of file {file_name} as PEM certificate")
file_path = f"{dir_path}/{file_name}"
p7data_str = open(file_path, "rb").read()
cert = load_pem_x509_certificate(p7data_str, default_backend())
print_cert_data(cert)
except Exception as e:
print(e)
if __name__ == "__main__":
get_pkcs7_content(ov_pem_file) # works
get_x509_content(ov_pem_file) # fails
get_pkcs7_content(oc_pem_file) # fails
get_x509_content(oc_pem_file) # worksThe following is the output. |
|
Thanks for clarifying. I see now that we shouldn't be returning the PEM encoding of the OC but rather return it as a CMS struct. I will create a PR for that. |
|
@ashwinkp8 Please take a look at the PR when you get a chance and let me know if I've missed anything. |
|
Hi Gareth Thanks. The PR verification was OK. Ashwini Kumar |
|
Hi, PKCS#7 and CMS which is ++version of PKCS#7, support "degenerate form" which can be used to transport certificates You can also check section 3.2 of RFC 8572 on how owner certificate is encoded in Secure-ZTP. Same can be done here. Also check: https://www.openssl.org/docs/manmaster/man1/openssl-crl2pkcs7.html Thanks, |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
as per the sztpd spec the owner certificate is a CMS structure specified by RFC5652. the owner certificate generated using the generate tool does not have follow the RFC. it does not have all the elements of the CMS struct
The text was updated successfully, but these errors were encountered: