OpenSSL › OpenSSL - User

Using OpenSSL to verify a FireFox signed form

_‹ Previous Topic Next Topic _›

Classic

List

Threaded

10 messages Options

Chris Covell

Using OpenSSL to verify a FireFox signed form

Hello there,

I have a signature signed using FireFox browser and want to verify the
signature using OpenSSL.

The signature seems to be in PEM format (i.e. base 64 encoded).

I can see the certificates that were used in the signature using:

openssl pkcs7 -print_certs -noout -in signature.pk7

But if I try and verify the signature using (as described in the
OpenSSL command line manual):

openssl smime -verify -inform PEM -in signature.pk7 -signer
signer_pub.key -certfile certs.pem -content content

I get the message:

Verification failure
1319:error:21075075:PKCS7 routines:PKCS7_verify:certificate verify
error:pk7_smime.c:222:Verify error:unable to get local issuer
certificate

I am sure I am nearly there, can anyone help me please ?

Chris...
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [hidden email]
Automated List Manager [hidden email]

Victor B. Wagner

Re: Using OpenSSL to verify a FireFox signed form

On 2005.05.24 at 11:14:08 +0100, Chris Covell wrote:

> But if I try and verify the signature using (as described in the
> OpenSSL command line manual):
>
> openssl smime -verify -inform PEM -in signature.pk7 -signer
> signer_pub.key -certfile certs.pem -content content
>
> I get the message:
>
> Verification failure
> 1319:error:21075075:PKCS7 routines:PKCS7_verify:certificate verify
> error:pk7_smime.c:222:Verify error:unable to get local issuer
> certificate
>
> I am sure I am nearly there, can anyone help me please ?

It asks for local (i.e. trusted) certificate of security authority,
who've issued (i.e. signed) signer's certificate.

Either provide path to the place where your trusted certificates are
stored using -CAfile or -CAdir argument, or specify -noverify to prevent
it from verifying certificate chain.

OpenSSL understands two forms of CA certificate storage

1. CAfile - file where PEM-formatted certificates are just concatenated
2. CAdir - directory where there are individual PEM certificate files
whose names are hashes obtained by openssl x509 -hash command.

______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [hidden email]
Automated List Manager [hidden email]

Chris Covell

Re: Using OpenSSL to verify a FireFox signed form

Victor, many thanks, I have got a bit further !

> > I am sure I am nearly there, can anyone help me please ?
>
> It asks for local (i.e. trusted) certificate of security authority,
> who've issued (i.e. signed) signer's certificate.
>
> Either provide path to the place where your trusted certificates are
> stored using -CAfile or -CAdir argument, or specify -noverify to prevent
> it from verifying certificate chain.

I am now using this command:

$ openssl smime -verify -inform PEM -in signature.pk7 -CAfile
development_cm.pem -content content.txt

And I get this output:

content
Verification failure
2788:error:21071065:PKCS7 routines:PKCS7_signatureVerify:digest
failure:pk7_doit.c:804:
2788:error:21075069:PKCS7 routines:PKCS7_verify:signature
failure:pk7_smime.c:265:

It looks like it is all working, just that it is failing verification.
But the content is so simple, that i can't believe that is the problem
! Is the problem CR/LF ? I am signing using FireFox on Windows to sign
but using OpenSSL on Linux to verify.

Any ideas ?

Chris...
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [hidden email]
Automated List Manager [hidden email]

Victor B. Wagner

Re: Using OpenSSL to verify a FireFox signed form

On 2005.05.24 at 14:33:29 +0100, Chris Covell wrote:

> I am now using this command:
>
> $ openssl smime -verify -inform PEM -in signature.pk7 -CAfile
> development_cm.pem -content content.txt
>
> And I get this output:
>
> content
> Verification failure
> 2788:error:21071065:PKCS7 routines:PKCS7_signatureVerify:digest
> failure:pk7_doit.c:804:
> 2788:error:21075069:PKCS7 routines:PKCS7_verify:signature
> failure:pk7_smime.c:265:
>
> It looks like it is all working, just that it is failing verification.
> But the content is so simple, that i can't believe that is the problem
> ! Is the problem CR/LF ? I am signing using FireFox on Windows to sign
> but using OpenSSL on Linux to verify.
>

Yes, CR/LF can be a problem. Many MTA feel free to convert eol from
CR/LF to LF and vice versa.

Try to play with -text and -crlfeol options of openssl smime.

For us there was more problems with generation of S/MIME messages which pass
all the mail servers on the way to recipient.

Other problem may be with Content-Transfer-Encoding.
Typically S/MIME computes digest of message after applying content-
encoding (such as Quoted-Printable or Base64) and including some mail
headers. If you receive such a message it is better to verify it as
SMIME format message passing it to openssl with all mail headers.

If you've extracted content you might forget to extract those headers
which was included in digest computation.

______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [hidden email]
Automated List Manager [hidden email]

Chris Covell

Re: Using OpenSSL to verify a FireFox signed form

Victor,

> > $ openssl smime -verify -inform PEM -in signature.pk7 -CAfile
> > development_cm.pem -content content.txt

> Yes, CR/LF can be a problem. Many MTA feel free to convert eol from
> CR/LF to LF and vice versa.

Yeah, but I am not using an MTA, I am signing the data in FireFox
browser and storing the resultant base64 encoded data in a database.

> Try to play with -text and -crlfeol options of openssl smime.

Does not seem to make any difference.

> For us there was more problems with generation of S/MIME messages which pass
> all the mail servers on the way to recipient.

Yeah, I have seen that too.

I can't believe other people have not seen this problem before, i.e.
signing on the client browser and verifying on the server using
OpenSSL !

Chris...
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [hidden email]
Automated List Manager [hidden email]

Dr. Stephen Henson

Re: Using OpenSSL to verify a FireFox signed form

On Wed, May 25, 2005, Chris Covell wrote:

> Victor,
>
> > > $ openssl smime -verify -inform PEM -in signature.pk7 -CAfile
> > > development_cm.pem -content content.txt
>
> > Yes, CR/LF can be a problem. Many MTA feel free to convert eol from
> > CR/LF to LF and vice versa.
>
> Yeah, but I am not using an MTA, I am signing the data in FireFox
> browser and storing the resultant base64 encoded data in a database.
>
> > Try to play with -text and -crlfeol options of openssl smime.
>
> Does not seem to make any difference.
>
> > For us there was more problems with generation of S/MIME messages which pass
> > all the mail servers on the way to recipient.
>
> Yeah, I have seen that too.
>
> I can't believe other people have not seen this problem before, i.e.
> signing on the client browser and verifying on the server using
> OpenSSL !
>

Have you tried the -binary option too?

I had no problems verifying signatures from the old signText function.

If you look at the PKCS#7 structure using:

openssl asn1parse -in p7.pem

and look for a line with 'messageDigest' and an OCTET STRING following it that
will give you the message digest value the content should be.

Steve.
--
Dr Stephen N. Henson. Email, S/MIME and PGP keys: see homepage
OpenSSL project core developer and freelance consultant.
Funding needed! Details on homepage.
Homepage: http://www.drh-consultancy.demon.co.uk
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [hidden email]
Automated List Manager [hidden email]

postme

Re: Using OpenSSL to verify a FireFox signed form

In reply to this post by Chris Covell

Are you exchanging messages between a windows client and a linux server? if
so have you considered the difference in linebreaks? UNIX and WINDOWS
interpret the "enter to the next line" ascii code in a different way. You
might want to replace the /\r\n|\r|\n/" sequence (in regex) with "\r\n".

cheers

Meint

----- Original Message -----
From: "Chris Covell" <[hidden email]>
To: <[hidden email]>
Sent: Wednesday, May 25, 2005 3:14 PM
Subject: Re: Using OpenSSL to verify a FireFox signed form

> Victor,
>
>> > $ openssl smime -verify -inform PEM -in signature.pk7 -CAfile
>> > development_cm.pem -content content.txt
>
>> Yes, CR/LF can be a problem. Many MTA feel free to convert eol from
>> CR/LF to LF and vice versa.
>
> Yeah, but I am not using an MTA, I am signing the data in FireFox
> browser and storing the resultant base64 encoded data in a database.
>
>> Try to play with -text and -crlfeol options of openssl smime.
>
> Does not seem to make any difference.
>
>> For us there was more problems with generation of S/MIME messages which
>> pass
>> all the mail servers on the way to recipient.
>
> Yeah, I have seen that too.
>
> I can't believe other people have not seen this problem before, i.e.
> signing on the client browser and verifying on the server using
> OpenSSL !
>
> Chris...
> ______________________________________________________________________
> OpenSSL Project http://www.openssl.org
> User Support Mailing List [hidden email]
> Automated List Manager [hidden email]
>
>

______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [hidden email]
Automated List Manager [hidden email]

Chris Covell

Re: Using OpenSSL to verify a FireFox signed form

In reply to this post by Dr. Stephen Henson

Hello there, thanks for taking the time to help !

> Have you tried the -binary option too?

Yes I have tried using binary... to no avail !

I have now gone back to basics and writen a short web page that just
asks for a signature and then writes the signature (with -----BEGIN
PKCS7----- header and footer) to a file. The content of the signature
is very simple with no CR/LF.

I use FireFox on a Linux box to sign the form.

I then try to verify the signature using:

openssl smime -verify -binary -inform PEM -in /tmp/sig95552 -CAfile
development_cm.pem -content test_content.txt

and get the result:

[chris@internal sbs]$ openssl smime -verify -binary -inform PEM -in
/tmp/sig95552 -CAfile development_cm.pem -content test_content.txt
sign test
Verification failure
20036:error:21071065:PKCS7 routines:PKCS7_signatureVerify:digest
failure:pk7_doit.c:804:
20036:error:21075069:PKCS7 routines:PKCS7_verify:signature
failure:pk7_smime.c:265:

> I had no problems verifying signatures from the old signText function.

Did you use the same openssl command as above ?

> If you look at the PKCS#7 structure using:
>
> openssl asn1parse -in p7.pem

OK...

> and look for a line with 'messageDigest' and an OCTET STRING following it that
> will give you the message digest value the content should be.

[chris@internal sbs]$ openssl asn1parse -in /tmp/sig95552

---snip---

2916:d=7 hl=2 l= 9 prim: OBJECT :signingTime
2927:d=7 hl=2 l= 15 cons: SET
2929:d=8 hl=2 l= 13 prim: UTCTIME :050526085914Z
2944:d=6 hl=2 l= 35 cons: SEQUENCE
2946:d=7 hl=2 l= 9 prim: OBJECT :messageDigest
2957:d=7 hl=2 l= 22 cons: SET
2959:d=8 hl=2 l= 20 prim: OCTET STRING
2981:d=5 hl=2 l= 13 cons: SEQUENCE
2983:d=6 hl=2 l= 9 prim: OBJECT :rsaEncryption
2994:d=6 hl=2 l= 0 prim: NULL
2996:d=5 hl=3 l= 128 prim: OCTET STRING

These are the last few lines, I can see the messageDigest line, how
would I interpret the OCTET STRING ?

I am sure I am missing something here, I am sure this should be simple !

Thanks again for your help.

Chris...
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [hidden email]
Automated List Manager [hidden email]

Chris Covell

Re: Using OpenSSL to verify a FireFox signed form

OK, I have sorted this out ! Thanks for those who have taken the time
to look at my problem. The issue in the end was that vi was putting a
"\n" at the end of my content file.

[chris@internal sbs]$ cat test_content.txt
sign test
[chris@internal sbs]$ hexdump -c test_content.txt
0000000 s i g n t e s t \n
000000a

So if I made sure that the content that was signed also had a "\n"
character it verified fine.

[chris@internal sbs]$ openssl smime -verify -inform PEM -in
/tmp/sig151839 -CAfile development_cm.pem -content test_content.txt
sign test
Verification successful

Many thanks

Chris...
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [hidden email]
Automated List Manager [hidden email]

Milan Dimitrijevic

Win ce port

I just sucesfully compiled library for ARM using evc4.0 compiler. Here
is what I had to do:

1. in C:\Program Files\Microsoft eMbedded C++ 4.0\EVC\wce420\bin I had
to change WCEARMV4.BAT so that set TARGETCPU=ARM instead of ARMV4

2. compiler reported internal error in
openssl-0.9.7d\crypto\rc2\rc2_skey.c
I had to add this line: ";ki = &c;" before "ki= &(key->data[63]);"
doesn't make sense but compiler was crashing in ki= &(key->data[63]);

3. rand\rand_win.c
#if defined(OPENSSL_SYS_WINCE) && (WCEPLATFORM!=MS_HPC_PRO) - error was
changed to
#if defined(OPENSSL_SYS_WINCE)
#if defined(WCEPLATFORM) && defined(MS_HPC_PRO)
#if (WCEPLATFORM!=MS_HPC_PRO)
with corespodning endifs

4. apps/apps.c had following code at 3 places
if (stat(dbfile,&sb) < 0)
{
if (errno != ENOENT
#ifdef ENOTDIR
&& errno != ENOTDIR)
#endif
goto err;
}

so if ENOTDIR was not defined ) was missing so it was changed to:
if (stat(dbfile,&sb) < 0)
{
if (errno != ENOENT
#ifdef ENOTDIR
&& errno != ENOTDIR
#endif
) // PARENTHESIS is outside if def
goto err;
}

regards
Milan

--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.322 / Virus Database: 266.11.17 - Release Date: 5/25/2005

______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [hidden email]
Automated List Manager [hidden email]