cconstab commented 4 years ago

I am checking certificates to see if the SAN/CN matches what I am expecting and everything works just fine until I started using certificates from BUYPASS.COM.

I use the same code with a LetsEncrypt and or a ZeroSSL cert and everything works as expected, I guess because they both include a CN/Subject.. Interestingly everything work fine also with a cert with a CN/Subject and SAN.. Example cert for that below also from stackoverflow..

Being a European CA they give out certificates without a CN but with a SAN and that causes a failure..

Unhandled exception: type 'ASN1Boolean' is not a subtype of type 'ASN1OctetString' in type cast

0 X509Utils._fetchSansFromExtension (package:basic_utils/src/X509Utils.dart:504:25)

1 X509Utils.x509CertificateFromPem. (package:basic_utils/src/X509Utils.dart:368:18)

2 List.forEach (dart:core-patch/growable_array.dart:282:8)

3 X509Utils.x509CertificateFromPem (package:basic_utils/src/X509Utils.dart:364:28)

4 main (file:///C:/Users/colin/Github/certcheck/bin/certcheck.dart:8:24)

5 _startIsolate. (dart:isolate-patch/isolate_patch.dart:299:32)

6 _RawReceivePortImpl._handleMessage (dart:isolate-patch/isolate_patch.dart:168:12)

Process finished with exit code 255

Small bit of sample code import 'dart:io';

import 'package:basic_utils/basic_utils.dart';

void main(List arguments) { var x509Pem = new File('testlab.pem').readAsStringSync(); var data = X509Utils.x509CertificateFromPem(x509Pem); var subjectAlternativeName = data.subjectAlternativNames; print("SAN: ${subjectAlternativeName}"); var commonName = data.subject["2.5.4.3"]; print("CN: ${commonName}"); print("---------------"); }

and a test.lab.shaduf.com cert to test with..

And the StackOverflow cert with CN and SAN

Ephenodrom commented 4 years ago

@cconstab

I checked the parsing method with a lot of different PEMs from different CAs like DigiCert, Sectigo and GlobalSign. But I never had a Certificate without a common name. I will update the method next week, so it will be able to parse X509 without subject data and will therefore take the common name out of the SAN list.

I will let you know when this is done.

Regards

Ephenodrom commented 4 years ago

@cconstab Busy week, will take a look at this next week.

Regards

cconstab commented 4 years ago

Busy here too! Thanks so much.. Colin

Ephenodrom commented 4 years ago

@cconstab Release 2.7.0-rc.1 is out now. Please check if this works now.

cconstab commented 4 years ago

Thanks I will check and let you know!

cconstab commented 3 years ago

Works Perfectly THANK YOU from all of our dev team!

Server viewpoint Connected from: SAN: [test.lab.shaduf.com] CN: null

Ephenodrom commented 3 years ago

@cconstab Nice too hear. Feel free to create a issue for feature requests if you have some nice ideas on how to improve this package.

Ephenodrom / Dart-Basic-Utils

X509Utils crash when cert has no CN but a SAN #28

0 X509Utils._fetchSansFromExtension (package:basic_utils/src/X509Utils.dart:504:25)

1 X509Utils.x509CertificateFromPem. (package:basic_utils/src/X509Utils.dart:368:18)

2 List.forEach (dart:core-patch/growable_array.dart:282:8)

3 X509Utils.x509CertificateFromPem (package:basic_utils/src/X509Utils.dart:364:28)

4 main (file:///C:/Users/colin/Github/certcheck/bin/certcheck.dart:8:24)

5 _startIsolate. (dart:isolate-patch/isolate_patch.dart:299:32)

6 _RawReceivePortImpl._handleMessage (dart:isolate-patch/isolate_patch.dart:168:12)