nsCertType field seems to be not set on certificates...

ghost commented 10 years ago

The field must be set to 'client' or 'server' depending on the certificate type.

olemaire commented 10 years ago

Strange.. Are you sure you use the latest release (on master) ?

olemaire commented 10 years ago

Bug confirmed. Fixing in progress.

olemaire commented 10 years ago

bug fixed. Anyway, not closing the ticket cause I wanna make sure coherency between x503v3 extensions (extendedKeyUsages) and nsCertType used as :

extendedKeyUsages: serverAuth, clientAuth, codeSigning, emailProtection, timeStamping, msCodeInd, msCodeCom, msCTLSign, msSGC, msEFS, nsSGC
nsCertType possible values: client, server, email, objsign, reserved, sslCA, emailCA, objCA.

olemaire commented 10 years ago

Bug still there:

even if OpenSSL can generate certificates with nsCertType the way they are in the actual code, and that OpenSSL verify these certificates with success,
SSL complains with some usages like HTTPS and OpenVPN when trying to verify the certificate for the nsCertType corespondency!

Example of the error with OpenVPN:

    Re-using SSL/TLS context
    LZO compression initialised
    TCP connection established with [AF_INET]<IP>:<PORT>
    TCPv4_SERVER link local: [undef]
    TCPv4_SERVER link remote: [AF_INET]<IP>:<PORT>
    VERIFY ERROR: depth=0, error=unsupported certificate purpose: /C=FR/O=COY/OU=Operationa
l_Unit/CN=test-client/emailAddress=support@domain.com
    TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIE
NT_CERTIFICATE:no certificate returned
    TLS Error: TLS object -> incoming plaintext read error
    TLS Error: TLS handshake failed
    Fatal TLS error (check_tls_errors_co), restarting

It could be an incoherency between nsCertType and extendedKeyUsage - or perhaps with keyUsage.

Need to be fixed.

olemaire commented 10 years ago

It seems OpenVPN want specific associations:

Reminder of possibles values (taxinomy):

extendedKeyUsages: serverAuth, clientAuth, codeSigning, emailProtection, timeStamping, msCodeInd, msCodeCom, msCTLSign, msSGC, msEFS, nsSGC
nsCertType possible values: client, server, email, objsign, reserved, sslCA, emailCA, objCA.
keyUsage: digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly and decipherOnly.

issuing keyUsage in coherency with nsCertType - seems working with nginx - let's test now with OpenVPN.

olemaire / spki

nsCertType field seems to be not set on certificates... #25