bugWeeChat - Bugs: bug #30316, sending client cert does not work

 
 

bug #30316: sending client cert does not work

Submitted by:  Ray Kohler <ataraxia>
Submitted on:  Thu 01 Jul 2010 06:19:17 PM UTC  
 
Category:  irc plugin Severity:  3 - Normal
Item Group:  irc protocol Status:  Fixed
Privacy:  Public Assigned to:  Sebastien Helleu <flashcode>
Originator Name:  Open/Closed:  Closed
Release:  0.3.2 IRC nick:  ataraxia

Add a New Comment (Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 25 Jul 2010 10:55:30 AM UTC, comment #5:

Fixed thanks to tip from Nikos.

Sebastien Helleu <flashcode>
Project AdministratorIn charge of this item.
Mon 19 Jul 2010 05:53:27 PM UTC, comment #4:
Sebastien Helleu <flashcode>
Project AdministratorIn charge of this item.
Fri 09 Jul 2010 09:28:23 AM UTC, comment #3:

Error with gnutls-cli, with a certificate/key created by openssl 1.0.0:

$ gnutls-cli --x509cafile CAs.pem --x509certfile nick.cer --x509keyfile nick.key --port 6697 irc.oftc.net
Processed 1 CA certificate(s).
Processed 1 client certificates...

      • Error loading key file: Base64 unexpected header error.

Certificate/key were created by this command:
$ openssl req -nodes -newkey rsa:2048 -keyout nick.key -x509 -days 365 -out nick.cer

Sebastien Helleu <flashcode>
Project AdministratorIn charge of this item.
Mon 05 Jul 2010 10:25:57 PM UTC, comment #2:

Hello!

After spending quite some time, I've finally resolved the mystery...

Problem is openssl package, i.e. Archlinux uses openssl-1.0.0a and Weechat cannot handle certificates created with this version.

However, when I created certificate with 0.9.80, everything is fine.

Now, it is interesting to find out exactly how 1.0.0 breaks the code.

Sincerely,
Gour

Anonymous
Fri 02 Jul 2010 08:54:31 AM UTC, comment #1:

Hi!

I can just confirm this bug and say that the same certificate which fails in Weechat works with Irssi. :-/

Sincerely,
Gour

Anonymous
Thu 01 Jul 2010 06:19:17 PM UTC, original submission:

(In addition to this writeup, see http://bbs.archlinux.org/viewtopic.php?pid=784740 for a couple of other users who reproduced this.)

I'm following the weechat instructions here: http://www.weechat.org/files/doc/stable … rtificates and also looking at OFTC's doc here: http://www.oftc.net/oftc/NickServ/CertFP

Verification via CA works fine (observe the 3rd line down):
Code:

20:12:26     oftc     | irc: connecting to server irc.oftc.net/6697 (SSL)...
20:12:26     oftc     | gnutls: connected using 2048-bit Diffie-Hellman shared secret exchange
20:12:26     oftc     | gnutls: peer's certificate is trusted
20:12:26     oftc     | gnutls: receiving 4 certificates
20:12:26     oftc     |  - certificate[1] info:
20:12:26     oftc     |    - subject `CN=oxygen.oftc.net', issuer `O=Open and Free Technology Community,OU=certification authority for irc,CN=irc.ca.oftc.net,EMAIL=support@oftc.net', RSA key 2048 bits, signed using RSA-SHA, activated
                      | `2009-08-07 14:31:48 UTC', expires `2010-08-07 14:31:48 UTC', SHA-1 fingerprint `852cb9bbab6ae5c5c3d4a745e255b175006e7314'
20:12:26     oftc     |  - certificate[2] info:
20:12:26     oftc     |    - subject `O=Open and Free Technology Community,OU=certification authority for irc,CN=irc.ca.oftc.net,EMAIL=support@oftc.net', issuer `O=Open and Free Technology Community,OU=Certification
                      | Authority,CN=ca.oftc.net,EMAIL=support@oftc.net', RSA key 2048 bits, signed using RSA-SHA, activated `2008-05-25 00:10:59 UTC', expires `2013-05-24 00:10:59 UTC', SHA-1 fingerprint
                      | `e45b2de35faec3e999209e34f7ce4c05b6adb73c'
20:12:26     oftc     |  - certificate[3] info:
20:12:26     oftc     |    - subject `O=Open and Free Technology Community,OU=Certification Authority,CN=ca.oftc.net,EMAIL=support@oftc.net', issuer `C=US,ST=Indiana,L=Indianapolis,O=Software in the Public
                      | Interest,OU=hostmaster,CN=Certificate Authority,EMAIL=hostmaster@spi-inc.org', RSA key 2048 bits, signed using RSA-SHA, activated `2008-05-24 23:53:25 UTC', expires `2013-05-23 23:53:25 UTC', SHA-1 fingerprint
                      | `27361360dd639f5ee74b07468345516fc0f052f1'
20:12:26     oftc     |  - certificate[4] info:
20:12:26     oftc     |    - subject `C=US,ST=Indiana,L=Indianapolis,O=Software in the Public Interest,OU=hostmaster,CN=Certificate Authority,EMAIL=hostmaster@spi-inc.org', issuer `C=US,ST=Indiana,L=Indianapolis,O=Software in the Public
                      | Interest,OU=hostmaster,CN=Certificate Authority,EMAIL=hostmaster@spi-inc.org', RSA key 4096 bits, signed using RSA-SHA, activated `2008-05-13 08:07:56 UTC', expires `2018-05-11 08:07:56 UTC', SHA-1 fingerprint
                      | `af70884383820215cd61c6bcecfd3724a990431c'

But then, when weechat tries to use my cert and key to do mutual auth, it fails. Notice that it claims to find a cert with the same subject as OFTC's CA in my client.pem file, which is nonsense:
Code:

20:12:26     oftc     | gnutls: sending one certificate
20:12:26     oftc     |  - client certificate info (/home/ataraxia/.weechat/ssl/client.pem):
20:12:26     oftc     |   - subject `C=US,ST=Indiana,L=Indianapolis,O=Software in the Public Interest,OU=hostmaster,CN=Certificate Authority,EMAIL=hostmaster@spi-inc.org', issuer `C=US,ST=Indiana,L=Indianapolis,O=Software in the Public
                      | Interest,OU=hostmaster,CN=Certificate Authority,EMAIL=hostmaster@spi-inc.org', RSA key 4096 bits, signed using RSA-SHA, activated `2008-05-13 08:07:56 UTC', expires `2018-05-11 08:07:56 UTC', SHA-1 fingerprint
                      | `af70884383820215cd61c6bcecfd3724a990431c'
20:12:26     oftc =!= | irc: TLS handshake failed
20:12:26     oftc =!= | irc: error: Insufficient credentials for that request.

I've double- and triple-checked that the contents of client.pem (MY cert and key, and nothing to do with OFTC or SPI) are correct.

What is going on here? Is weechat really using the wrong creds to authenticate me? (If that's so, at least it explains the "Insufficient credentials" error, as of course I don't have the key for SPI's CA.)

Ray Kohler <ataraxia>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by flashcode (Posted a comment)
  • -email is unavailable- added by ataraxia (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-08-07 flashcode Open/ClosedOpen => Closed
    2010-07-26 flashcode StatusReady For Test => Fixed
    2010-07-25 flashcode StatusIn Progress => Ready For Test
    2010-07-09 flashcode StatusNone => In Progress
        Assigned toNone => flashcode

    Back to the top


    Powered by Savane 3.4