Signature verification failed, the private key doesn't match the certificate

[outrunthewolf]

Hi, I'm consistently getting Signature verification failed, the private key doesn't match the certificate

I'm running JSign on Linux Ubunutu

I'm using GCP KMS and this is my command:

jsign --storetype GOOGLECLOUD --storepass $(gcloud auth print-access-token) \
--keystore projects/PROJECT/locations/us-east1/keyRings/KEYRING \
--alias KEYNAME --certfile chain.pem \
my.exe

What I know:

• I'm convinced JSign is selecting the correct key from my keyring, omitting alias lists out the keys available correctly.
• I'm convinced my private key and certificate do match. I've run openssl md5 on the certificate, and the public key and all match. I'm not sure how I can test the private key from GCP though.

My only other idea is my certfile is incorrectly formatted. In some cases I can see people using .pem (chained certs) and documentation mentions PKCS#7 or P7B format.

My certfile looks like:

-----BEGIN CERTIFICATE-----

... My cert

-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----

... Certificate Authority

-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----

... trusted root

-----END CERTIFICATE-----

Is there anyway you can give more information on the certfile formatting? Is there further way to run the JSign program in debug or verbose mode? Perhaps that could help me spot an issue.

Thanks.

[ebourg]

How is configured your private key? Did you select PKCS#1 v1.5 padding?

[oleksii-tymofieiev]

Is there a plan to support RSA-PSS key in jsign?

[ebourg]

My understanding is that Authenticode doesn't support RSA-PSS, but I may be wrong.

[oleksii-tymofieiev]

Thank you for your answers @ebourg and for the great work you are doing.

[ebourg]

@oleksii-tymofieiev You're welcome. Do you think you could send your signing certificate with the RSA-PSS key to ebourg@apache.org? I'd like to do some tests and see if I can print a useful error message when such a key is used.

[apique13]

Hi, I've got a similar issue with a YUBIKEY. Signature Algorithm sha384ECDSA Public key ECDSA_P384, ECC (384 bits) I can't tell you more, I can't see the private key. Thanks

[ebourg]

@apique13 What command line did you use?

[apique13]

Sorry, I think the problem is maybe the certificate on my yubikey. I tried with signtool too, there is no error, but the outpur file is not properly signed.