CertificateChainValidationEngine.verify always retrieves false (resultCode: -1)

filipap commented 3 years ago

Good morning, i'm using pkijs on my ionic cli v5 app. When I use the CertificateChainValidationEngine to verify the certificate chain, it always gives me that error:

result: false
resultCode: -1
resultMessage: "No valid certificate paths found"

After some researching i found that issue, https://github.com/PeculiarVentures/PKI.js/issues/259, and I imported the lib @peculiar/webcrypto. However it still fails. Any suggestion? (PS. Ionic apps runs over nodejs)

YuryStrozhevsky commented 3 years ago

It is impossible to say anything without a full certificate chain (end-user certificates + all certificates of CAs). Also would be better to have your code which is working wirh PKIjs validation engine. BTW have you seen this and this?

filipap commented 3 years ago

@YuryStrozhevsky Root CA (self-signed certificate):

Digital Signature certificate:

the code I use to verify:

let root_cert_der = decodeCert(root_cert_pem);
let ds_cert_der = decodeCert(ds_cert_pem);
let trustedCertificates = [];
let certificates_to_verify = [];
let crls = [];
trustedCertificates.push(root_cert_der);
certificates_to_verify.push(ds_cert_der);
const certChainVerificationEngine = new pkijs.CertificateChainValidationEngine({
                trustedCertificates,
                certs: certificates_to_verify,
                crls
});

let result = await certChainVerificationEngine.verify();

function decodeCert:

function decodeCert(pem) {
  if(typeof pem !== 'string') {
      throw new Error('Expected PEM as string');
  }

  // Load certificate in PEM encoding (base64 encoded DER)
  const b64 = pem.replace(/(-----(BEGIN|END) CERTIFICATE-----|[\n\r])/g, '');

  // Now that we have decoded the cert it's now in DER-encoding
  const der = Buffer.from(b64, 'base64');

  // And massage the cert into a BER encoded one
  const ber = new Uint8Array(der).buffer;

  // And now Asn1js can decode things
  const asn1 = asn1js.fromBER(ber);

  return new pkijs.Certificate({ schema: asn1.result });
}

YuryStrozhevsky commented 3 years ago

I have tested it using this live example - all works fine with decoded (binary) data. So, I do suspect you have troubles decoding BASE-64. There were a number of similar issues, check this one for example. You could also search for "BASE-64" in closed issues.

filipap commented 3 years ago

I have tested it using this live example - all works fine with decoded (binary) data. So, I do suspect you have troubles decoding BASE-64. There were a number of similar issues, check this one for example. You could also search for "BASE-64" in closed issues.

After some researching inside https://github.com/PeculiarVentures/PKI.js/issues/208, I followed your suggestion and I changed the base64 decode function from this:

const der = Buffer.from(b64, 'base64');

const ber = new Uint8Array(der).buffer;

to this (used by the lib as well):

const ber = pvutils.stringToArrayBuffer(pvutils.fromBase64(b64))

And it worked absolutely fine! 😄 Thank you so much for your patience!

PeculiarVentures / PKI.js

CertificateChainValidationEngine.verify always retrieves false (resultCode: -1) #284