Menu
▾
▴
#995 Unable to Request SSL Client Certificate
Hi,
When I visit:
https://myserver.net:10000/acl/cert_form.cgi
The page loads correctly, but the 'Loading...' box is
never populated with CSP details. The page finishes
loading, but on submitting (in IE6), a script error occurs
(obviously because I can't select a CSP!):
Line: 100
Char: 3
Error: Object doesn't support this property or method:
'Enroll.RequestStoreFlags'
Code: 0
SSL and all that jazz is fine at the server end, so I
guess there's a problem with my local CSPs?
Logged In: NO
OK, found the problem myself. Microsoft fairly recently
issued a patched XEnroll.dll, and for some reason changed
the clsid. Now, in two Webmin files:
* cert_form.cgi
* cert_issue_ie.cgi
The clsid for the Enroll object needs to be changed:
From: 43F8F289-7A20-11D0-8F06-00C04FC295E1
To: 127698e4-e730-4e5c-a2b1-21490a70c8a1
Hope this helps...
Logged In: NO
Final step in the sage - the acceptPKCS7 method returns an
error now, and I can't work out why. Perhaps the behaviour of
XEnroll has changed now...
Logged In: YES
user_id=129364
Webmin includes its own xenroll.dll file that I thought
would be used instead of any on your system .. though to be
honest my knowledge of IE and dlls is not too good.
Is there any way to force the use of the dll that webmin
provides?
Logged In: YES
user_id=645299
This must be a problem with Microsoft's implementation of
the Soap Enroll.dll. I have used Mozilla and the page
generation works perfectly.
Anyway to abandon the VBScript code for IE and just use
whatever methods are used for Netscape/Mozilla?
Logged In: YES
user_id=129364
No, the HTML code that works with Mozilla and Netscape does
not work with IE :-(
Which exact IE version are you running there, and on which OS?
Logged In: YES
user_id=645299
I'm running IE 6.0 with Windows XP Professional.
I am also running Mozilla 1.2.1.
Logged In: NO
The problem occurred for me, the original anonymous one,
using Win XP, IE 6 (latest patches). As I mentioned, I fixed
most of it by changing the clsid, but I couldn't work out why
the acceptPKCS7 method doesn't work with the updated
xenroll.dll (CEnroll class)...
Logged In: YES
user_id=129364
Where did this updated xenroll.dll come from? Was it
installed by a recent windows update?
Logged In: NO
Yes. I believe it came with the latest IE6 security roll-up, but
I can't tell you for sure.
Logged In: YES
user_id=645299
I actually dont have the file on my computer, but there are
entries for it in the registry.
Logged In: YES
user_id=129364
If that file doesn't exist on your system, I would have
thought that the xenroll.dll that comes with Webmin would be
used .. However, if a newer version did exist, then I could
see how the browser might use it instead.
Logged In: YES
user_id=645299
perhaps just having the registry keys is throwing off my
browser.
Logged In: YES
user_id=129364
What are the names and values of these registry keys? I'd
like to take a look at them on my own systems ..
Logged In: YES
user_id=645299
The key is:
HKCR\CLSID\{127698e4-e730-4e5c-a2b1-21490a70c8a1}.
Logged In: YES
user_id=280841
From where can I access the client cert functionality? I see
that the file exists but I can't find a way to access it in the
webmin configuration.
Logged In: YES
user_id=129364
Client certs can be issued by clicking on 'Request an SSL
Certificate' at the bottom of the the Webmin Users module.
Of course, you need to turn on SSL and generate a CA cert
first ..
Logged In: YES
user_id=280841
Well, I turned on SSL and replaced miniserv.pem with an own
cert signed by our CA. I created that file outside of Webmin
with openssl. So, I didn't bother about the CA (edit_ca.cgi)
nor about the Create SSL key option on edit_ssl.cgi. So, I
wasn't even aware that you added this functionality until I
read this bug report by accident. How many other users
aren't?
Well, what have I to do now so that Webmin uses my already
existing CA cert and key to sign? I don't want to create a
new CA. Should I paste cert and public key in the "Edit CA
certificate" box and save?
Logged In: YES
user_id=129364
You can paste your existing CA cert into the 'Edit CA
certificate' box, assuming that it is in PEM format and
contains both the cert and private key sections. Then users
can request certs using the Webmin Users module ..
Logged In: YES
user_id=280841
Thanks, works fine. However, I'm not sure that I like getting
the private key presented on that page each time I open it.
Can't we do anything about this?
Now for the bug. I'm now getting the same error as reported. I
think it's caused because the old Xenroll.dll had a serious
security flaw. So, they changed the CLSID that there can't
happen any accidental access. You can find an explanation
and also a tutorial how to adapt your pages to the new
control on this page:
http://support.microsoft.com/default.aspx?scid=kb;en-
us;323172
As I see you are using version 2146 of this control, that one
is quite old and affected by this security flaw. I think once
you have done so you don't need this file on your side.
However, if you do I'll be glad to provide you with the updated
control.
Logged In: YES
user_id=129364
Kai : I think having the private key appear is inevitable,
as it has to be sent back to the browser somehow.
As for the new xenroll.dll, I have created an updated
version of the module (attached to this bug report) that
uses it. Give it a try ..
Updated Webmin Users module
Logged In: YES
user_id=280841
Ok, I see, I just feel wary about this.
The new module gets me to the point that the cert gets
generated and I click the Install button. Now I get the same
type of error, just in cert_issue_ie.cgi, Line: 26, Char: 9
Cannot find object or property.
BTW: our normal users don't have access to the "Webmin
Users" page because there's simply nothing on it they should
be able to see or edit. I have seen this page strictly as "my"
page to administer user settings. But if I want them to be
able to retrieve certificates I have to allow them access to
this module and change all the many options for this module
to no for each of them. It seems a bit illogical to me to have
all this on the same page because there's a difference
between changing the theme or retrieving a client cert for
*me* and creation of new webmin users and editing of *other*
webmin users.
Logged In: YES
user_id=129364
Kai: Once I get this problem with actually issuing the cert
with microsoft's new DLL solved, I'll create a simple
third-party module just for the current webmin user to
request a cert for himself.
Logged In: YES
user_id=280841
Jamie: Great. Maybe that's also a good option for Usermin
(haven't seen the latest versions of Usermin, so maybe it's
already there).
As I said I wasn't able to install the created cert. I assume I
could download and install it, though, assuming that you
stored it somewhere within /etc/webmin. When I connected
next time, I was asked to choose a cert and couldn't, of
course. After clicking cancel I got logged in. That wasn't so
bad since otherwise I would have had to login via SSH and try
to disable this. But it makes me wonder from a security point-
of-view, if this is the expected behavior or if I rather should get
refused access if I can't present a cert. Also, does Webmin
now ask *any* user for a cert or just me? Could it be that the
login was successful, because it used my permanent cookie
or would it have allowed me to login "normally", anyway?
Apart from these questions: if you want to bug-test an
updated module I'll be happy to do so.
Logged In: YES
user_id=645299
OK, with your new updated module, I get the message that
the cert has been created, but when I click the button to
install it, I get a vbscript error:
Line: 29
Char: 9
Error: Cannot find object or property.
Code: 0
I have no idea how this stuff works so I may venture a guess
and say that the hidden value isn't formatted correctly?