Getting Error while importing certificate

nitzien commented 4 years ago

I get following error in importing a pem certificate. Tried with multiple certificates including self signed certificate.

Chrome error:

Firefox error:

Thanks, Nitin

rmhrisk commented 4 years ago

Can you give us more information?

A copy of the certificate in question?

Console logs from your browser?

Make and model of the device your trying to import to?

The fortify logs while performing this action?

nitzien commented 4 years ago

Console logs from chrome browser on Ubuntu 18.04

{type: "ERROR", data: DOMException: Failed to execute 'atob' on 'Window': The string to be decoded is not correctly encod…, action: "import_item", @@redux-saga/SAGA_ACTION: true}action: "import_item"data: DOMException: Failed to execute 'atob' on 'Window': The string to be decoded is not correctly encoded.
    at Object.prepareCertToImport (https://tools.fortifyapp.com/assets/js/main.cfa1a3f5.chunk.js:1:115606)
    at https://tools.fortifyapp.com/assets/js/main.cfa1a3f5.chunk.js:1:258064
    at c (https://tools.fortifyapp.com/assets/js/vendors~main.e70bccc7.chunk.js:1:42995)
    at Generator._invoke (https://tools.fortifyapp.com/assets/js/vendors~main.e70bccc7.chunk.js:1:42748)
    at Generator.forEach.e.<computed> [as next] (https://tools.fortifyapp.com/assets/js/vendors~main.e70bccc7.chunk.js:1:43352)
    at b (https://tools.fortifyapp.com/assets/js/npm.redux-saga.38b36b35.chunk.js:1:14618)
    at K (https://tools.fortifyapp.com/assets/js/npm.redux-saga.38b36b35.chunk.js:1:14406)
    at https://tools.fortifyapp.com/assets/js/npm.redux-saga.38b36b35.chunk.js:1:11046
    at h (https://tools.fortifyapp.com/assets/js/npm.redux-saga.38b36b35.chunk.js:1:7519)
    at N.<computed> (https://tools.fortifyapp.com/assets/js/npm.redux-saga.38b36b35.chunk.js:1:11026)code: 5message: "Failed to execute 'atob' on 'Window': The string to be decoded is not correctly encoded."name: "InvalidCharacterError"stack: (...)get stack: ƒ ()set stack: ƒ ()__proto__: DOMExceptiontype: "ERROR"@@redux-saga/SAGA_ACTION: true__proto__: Object

ERROR MESSAGE: DOMException: Failed to execute 'atob' on 'Window': The string to be decoded is not correctly encoded.
    at Object.prepareCertToImport (https://tools.fortifyapp.com/assets/js/main.cfa1a3f5.chunk.js:1:115606)
    at https://tools.fortifyapp.com/assets/js/main.cfa1a3f5.chunk.js:1:258064
    at c (https://tools.fortifyapp.com/assets/js/vendors~main.e70bccc7.chunk.js:1:42995)
    at Generator._invoke (https://tools.fortifyapp.com/assets/js/vendors~main.e70bccc7.chunk.js:1:42748)
    at Generator.forEach.e.<computed> [as next] (https://tools.fortifyapp.com/assets/js/vendors~main.e70bccc7.chunk.js:1:43352)
    at b (https://tools.fortifyapp.com/assets/js/npm.redux-saga.38b36b35.chunk.js:1:14618)
    at K (https://tools.fortifyapp.com/assets/js/npm.redux-saga.38b36b35.chunk.js:1:14406)
    at https://tools.fortifyapp.com/assets/js/npm.redux-saga.38b36b35.chunk.js:1:11046
    at h (https://tools.fortifyapp.com/assets/js/npm.redux-saga.38b36b35.chunk.js:1:7519)
    at N.<computed> (https://tools.fortifyapp.com/assets/js/npm.redux-saga.38b36b35.chunk.js:1:11026)

nitzien commented 4 years ago

Not seeing any logs in fortify.log. Possibly because failure is happening in browser javascript while importing certificate itself.

nitzien commented 4 years ago

A sample self signed certificate

nitzien commented 4 years ago

Also tried with unencrypted private key.

rmhrisk commented 4 years ago

@donskov please take a look, it seems tools.fortifyapp.com has a regression

nitzien commented 4 years ago

Is there an easy hack where I can copy paste cert / key content in ~/.fortify folder somewhere to make it work for now?

Just for development work.

rmhrisk commented 4 years ago

This is only an issue in tools.fortify.com and shouldn't impact any API calls.

rmhrisk commented 4 years ago

@nitzien are you trying to import both a private key and certificate in the formats specified?

nitzien commented 4 years ago

It is pem private key and certifcate as mentioned above.

rmhrisk commented 4 years ago

This UI is for importing a certificate and not keys and certificates.

nitzien commented 4 years ago

How does one import a signing certificate which will be combination of public certificate and private key?

rmhrisk commented 4 years ago

You can write code to do an import of a key with fortify, but this tool is a certificate import tool, not a private key import tool.

You would normally generate a key on the client, create a CSR, get a cert with that CSR, then install the certificate which is why we didn't create a tool to import private keys in this fashion.

nitzien commented 4 years ago

Thanks a lot.

So if we have certificate for which key was not generated on machine where signing will be done, we will need to write code for it?

rmhrisk commented 4 years ago

Or convince us to add capability into Foritfy; right now it just looks like bad security practice.

nitzien commented 4 years ago

In theory, I completely agree with you that it will be bad security practice to share or transfer keys. But in reality, ssl as well as signature certificates (and keys) are shared within company. It will not be possible to get different certificate for every machine.

May be it should be done but not through tools.fortify.com but a local UI.

rmhrisk commented 4 years ago

Passing clear text keys, or even password-protected keys (which are trivially grindable), around leaves "key turds" in swap files, email, filesystems, shared clipboards, and many other locations. There may be cases in which handling keys in this fashion is unavoidable but it is far from good practice.

If you explain the use case I may be able to provide some guidance that can lessen the impact of the business requirement.

nitzien commented 4 years ago

Keys in pem as well pfx can be password protected. One above is encrypted private key. No doubt they can be cracked with brute force. :)

rmhrisk commented 4 years ago

Yes, they can be but PFX, for example, can be encrypted to an asymmetric key pair, which can not be, if you give me more information I can possibly help you do this in a secure way.

nitzien commented 4 years ago

I am working on project where we need to sign pdf. Similar to setasign. But this will be on Ruby on Rails instead of php. Users will mostly have USB token to sign. But possibly they may also have signtature in pfx or pem file.

rmhrisk commented 4 years ago

What platforms does your solution need to work on and where/how will the users be getting these certificates?

nitzien commented 4 years ago

Client machines will be windows. I am currently using Ubuntu though. Client will buy these certificates online. USBs are physically delivered. And if files, it will be downloadable.

nitzien commented 4 years ago

I see here. https://www.e-mudhra.com/portal/Subscriber/Login.aspx

rmhrisk commented 4 years ago

If client machines are going to be Windows, why not just use the Windows enrollment flows and if appropriate the CAs existing enrollment capabilities?

rmhrisk commented 4 years ago

I am familiar with http://e-mudhra.com, please tell Vijay hi.

If your creating a certificate enrollment flow for e-mudhra using fortify, then the right thing to do is to do an enrollment where you generate the key on the machine and install the resulting certificate; this will leave the protection of the key up to the OS/browser.

If you are trying to use certificates purchased from another CA it seems letting that process be independent of the signing workflow seems appropriate. For example in our document signing solution where we use Fortify, we support dynamically enrolled certs in the browser (you would probably be doing server-side keys/signing instead, signing with certificates in OS/browser store (such as those in CAPI/NSS) -- done via fortify, and signing with USB smart cards, again, using smart cards -- done using fortify.

If you are doing the signing flow, then I strongly recommend you look at the web component we recently released as it handles the use cases for you - https://fortifyapp.com/developers

I should also add we will be creating a web component for certificate enrollment in the coming weeks also.

nitzien commented 4 years ago

Thanks a lot. Will check out web component.

donskov commented 3 years ago

Web component for certificate enrollment created - https://fortifyapp.com/docs/webcomponents/fortify-enrollment/readme. @nitzien Try to use.

nitzien commented 3 years ago

Thanks. Is this available in 1.5.0?

Will try this out.

PeculiarVentures / fortify

Getting Error while importing certificate #330