Re: [Trustedjava-support] APKI and openssl

[Simon M. <sim...@in...>]

Hi,

thank you for your reply.

The asn1parse works fine also on my part.

But I would like to verify the issued EKCertificate through openssl:

I first run:
sh client.sh ekcert_create --ekfile EKTest.der -o owner --host 
privacyca.iaik.tugraz.at --port 10011
then i download the EK issueing certificate 
http://opentc.iaik.tugraz.at/certs/caek.cert

convert them to pem:
openssl x509 -inform der -in caek.cert -outform pem -out CAEK.pem
openssl x509 -inform der -in EKTest.der -outform pem -out EKTest.pem

and then i try to display the public key of EKTest.der:
openssl x509 -inform pem -in EKTest.pem -noout -pubkey
error:
Error getting public key
13852:error:0D09B0A3:asn1 encoding routines:d2i_PublicKey:unknown public 
key type:d2i_pu.c:125:
13852:error:0B077066:x509 certificate routines:X509_PUBKEY_get:err asn1 
lib:x_pubkey.c:366:

or to verify the certifiacte chain:
openssl verify -CAfile CAEK.pem EKTest.pem
error:
EKTest.pem:
error 20 at 0 depth lookup:unable to get local issuer certificate
13850:error:0D09B0A3:asn1 encoding routines:d2i_PublicKey:unknown public 
key type:d2i_pu.c:125:
13850:error:0B077066:x509 certificate routines:X509_PUBKEY_get:err asn1 
lib:x_pubkey.c:366:
13850:error:0B06E06C:x509 certificate 
routines:X509_get_pubkey_parameters:unable to get certs public 
key:x509_vfy.c:1152:

Martin, unfortunately the verify command of openssl does only accept PEM 
encoded certificates. But the error in the x509 command happens also 
with der encoded certificates.

Maybe I am doing that the wrong way. Is there another possibility to 
verify this chain with openssl?
I tried also to verify the same certificates through a small JAVA 
program, using the JCE library, which works fine. So it is just a matter 
of formatting the public key, when it is written to the file?

Thank you in advance!

Kind regards,
Simon


Martin Pirker wrote:
> Hi...
>
> Simon Mittelberger wrote:
> [...]
>   
>> When I execute the following openssl command i get an error:
>> openssl -inform PEM -in cert.pem -noout -modulus
>>     
>
> The actual openssl command is missing in this example?
>
> [...]
>   
>> It looks like the public key isn't encoded in the right manner.
>>
>> Has anyone a suggestion?
>>     
>
> Is this only happening with PEM encoding?
>
> I tried decoding a DER encoded EK certificate with the standalone dumpasn1
> utility and via "openssl asn1parse -inform DER -in ek.cert"
> This works fine.
>
> HTH,
> Martin
>