search

open-quantum-safe / openssl

UNSUPPORTED Fork of OpenSSL 1.1.1 that includes prototype quantum-resistant algorithms and ciphersuites based on liboqs PLEASE SWITCH TO OQS-Provider for OpenSSL 3
https://openquantumsafe.org/
Other
286 stars 124 forks source link

Unable to verify certificate chains when generated with PQ algorithms #413

Closed sandilya761 closed 1 year ago

sandilya761 commented 1 year ago

I am getting following error during certificate chain verification: error 6 at 1 depth lookup: unable to decode issuer public key

I am unable to verify my certificate chains which are generated with post quantum schemes like dilithium2,dilithium2_aes while I was able to verify with classical schemes like RSA, ECDSA. I am using OQS openssl library to generate my certificate chains.

Following is my verification command.

openssl verify -CAfile CA.pem combined.pem CA.pem is the root CA certificate file and combined.pem is a single certificate containing intermediate certificate and server certificate.

After running the above mentioned command, following is my output. image

As per output, CA certificate is being verified but not intermediate certificate and server certificate.

My Openssl version: OpenSSL 1.1.1g 21 Apr 2020 Make version: GNU Make 4.3

Kernel version: 5.7.0-kali1-amd64.

baentsch commented 1 year ago

This error message is typical for a non-OQS openssl operating on OQS-certs. Are you 110% certain you are running oqs-openssl in the command above and not a standard openssl? Please post the output of running "openssl version".

sandilya761 commented 1 year ago

What do you mean by non-OQS openssl? I cloned this repo and followed all the mentioned steps. Following is the output of running the command openssl version

image

baentsch commented 1 year ago

This confirms precisely what I mean: You are not running oqs-openssl with the command above. Make sure you set PATH correctly (or explicitly call ./apps/openssl). The output must be like this:

$ openssl version
OpenSSL 1.1.1s  1 Nov 2022, Open Quantum Safe 2022-11
sandilya761 commented 1 year ago

It's working now. Thank You very much!!