Leaf cert missing in certificatePath returned by CertificateChainValidationEngine.verify()

themighty1 commented 3 years ago

Hi, I'm trying to find a way of seeing the exact cert chain which was chosen out of the certs supplied to CertificateChainValidationEngine. I was hoping to see the whole chain from leaf to root in the returned value "certificatePath" but it only shows the intermediate and the root cert. It does not show the leaf cert.

Is this by design? Is there a way I could find out which cert was chosen as the leaf cert?

Thank you.

themighty1 commented 3 years ago

To provide some more info. I created a trusted cert and a leaf cert signed directly by it. (no intermediate certs) With those certs .verify() returns "certificatePath" which has both leaf and root.

So, after all, under certain circumstances the whole chain is returned but like I said above when the intermediate cert was supplied, the leaf cert was NOT returned.

themighty1 commented 3 years ago

Here are the certs: leaf:

intermediate:

root:

YuryStrozhevsky commented 3 years ago

@themighty1 When you are using CertificateChainValidationEngine class you directly point which user certificate you need to build chain for. It is the least certificate in input array of certificates. So I do not think it is even necessary to put this already known certificate as an output.

themighty1 commented 3 years ago

@YuryStrozhevsky , thanks. However, I'm experiencing situations where the least certificate ( i.e. with zero index [0] ) is NOT selected for the certificatePath.

For example, I have 3 certs: rootCert (CommonName: TRUSTED_ROOT) and 2 leaf certs signed by rootCert (cert1's /CN=127.0.0.1 and cert2's /CN=example.com)

When I do:

var ccve = new CertificateChainValidationEngine({
          trustedCerts: [rootCert],
          certs: [cert1, cert2],
        });
var rv = await ccve.verify()

then rv.certificatePath returns [cert2, rootCert]

When I swap them around and do:

var ccve = new CertificateChainValidationEngine({
          trustedCerts: [rootCert],
          certs: [cert2, cert1],
        });
var rv = await ccve.verify()

then rv.certificatePath returns [cert1, rootCert]

(You'll have to look at the Common Name value to distinguish which cert is returned in rv.certificatePath)

rootCert.pem

cert1.pem

cert2.pem

YuryStrozhevsky commented 3 years ago

@themighty1 Not sure that I understood you correctly. Or maybe you did not. So, as I said your chain would be built for least certificate in the certs array. And you described completely correct output. What do you need here?

YuryStrozhevsky commented 3 years ago

@themighty1 Or maybe you are "testing" our certificate verification engine? In this case take a look at this example - here I made a test for complete set of test cases for NIST PKITS (PKI Test Suite).

themighty1 commented 3 years ago

@YuryStrozhevsky, I just want to make sure that I understand what is "the least certificate in an input array" e.g. if the input array is [cert1, cert2] then the least certificate is cert1, is that correct?

YuryStrozhevsky commented 3 years ago

@themighty1 Frankly speaking I am Russian and English is not my native, but I had a vision that "least = certificate in very end of array". So for this case:

[
   cert1,
   cert2
]

the "least = cert2". And for this case"

[
   cert2,
   cert1
]

the "least = cert1".

themighty1 commented 3 years ago

@YuryStrozhevsky , thanks for explaining, it makes sense now.

Going back to the rv.certificatePath matter:

when I supply 4 certs like this [cert1, intermediate1, intermediate2, root] then rv.certificatePath returns [intermediate2, root]]

It seems like certificatePath returns only 2 certificates, no matter what the length of the actual chain is.

themighty1 commented 3 years ago

Just to clarify: cert1 is signed by intermediate1 intermediate1 is signed by intermediate2 intermediate2 is signed by root

YuryStrozhevsky commented 3 years ago

@themighty1 Put cert1 at the place where least should be. The "leaf" cert MUST be least.

YuryStrozhevsky commented 3 years ago

The "root" must be in a separate parameter "trustedCertificates". Like in example:

        it.skip("4.15.10 Invalid delta-CRL Test10", simpleVerification({
            trustedCertificates: [
                "TrustAnchorRootCertificate.crt"
            ],
            certificates: [
                "deltaCRLCA3Cert.crt",
                "InvaliddeltaCRLTest10EE.crt"
            ],
            crls: [
                "TrustAnchorRootCRL.crl",
                "deltaCRLCA3CRL.crl",
                "deltaCRLCA3deltaCRL.crl"
            ],
            successExpected: false
        }));

themighty1 commented 3 years ago

Thank you, finally all my woes came to an end after placing the leaf cert last in the array of certs. For bonus points, certificatePath now returns FULL path from leaf to root. Just what I needed. Thank you for your time.

PeculiarVentures / PKI.js

Leaf cert missing in certificatePath returned by CertificateChainValidationEngine.verify() #294