X509Utils crash when cert has no CN but a SAN #28

cconstab · 2020-10-04T02:03:00Z

I am checking certificates to see if the SAN/CN matches what I am expecting and everything works just fine until I started using certificates from BUYPASS.COM.

I use the same code with a LetsEncrypt and or a ZeroSSL cert and everything works as expected, I guess because they both include a CN/Subject.. Interestingly everything work fine also with a cert with a CN/Subject and SAN.. Example cert for that below also from stackoverflow..

Being a European CA they give out certificates without a CN but with a SAN and that causes a failure..

Unhandled exception:
type 'ASN1Boolean' is not a subtype of type 'ASN1OctetString' in type cast
#0 X509Utils._fetchSansFromExtension (package:basic_utils/src/X509Utils.dart:504:25)
#1 X509Utils.x509CertificateFromPem. (package:basic_utils/src/X509Utils.dart:368:18)
#2 List.forEach (dart:core-patch/growable_array.dart:282:8)
#3 X509Utils.x509CertificateFromPem (package:basic_utils/src/X509Utils.dart:364:28)
#4 main (file:///C:/Users/colin/Github/certcheck/bin/certcheck.dart:8:24)
#5 _startIsolate. (dart:isolate-patch/isolate_patch.dart:299:32)
#6 _RawReceivePortImpl._handleMessage (dart:isolate-patch/isolate_patch.dart:168:12)

Process finished with exit code 255

Small bit of sample code
import 'dart:io';

import 'package:basic_utils/basic_utils.dart';

void main(List arguments) {
var x509Pem = new File('testlab.pem').readAsStringSync();
var data = X509Utils.x509CertificateFromPem(x509Pem);
var subjectAlternativeName = data.subjectAlternativNames;
print("SAN: ${subjectAlternativeName}");
var commonName = data.subject["2.5.4.3"];
print("CN: ${commonName}");
print("---------------");
}

and a test.lab.shaduf.com cert to test with..

And the StackOverflow cert with CN and SAN

Ephenodrom · 2020-10-04T11:29:48Z

@cconstab

I checked the parsing method with a lot of different PEMs from different CAs like DigiCert, Sectigo and GlobalSign. But I never had a Certificate without a common name. I will update the method next week, so it will be able to parse X509 without subject data and will therefore take the common name out of the SAN list.

I will let you know when this is done.

Regards

Ephenodrom · 2020-10-09T20:37:40Z

@cconstab
Busy week, will take a look at this next week.

Regards

cconstab · 2020-10-10T01:43:28Z

Busy here too! Thanks so much.. Colin

Ephenodrom · 2020-10-14T15:11:59Z

@cconstab Release 2.7.0-rc.1 is out now. Please check if this works now.

cconstab · 2020-10-14T16:50:49Z

Thanks I will check and let you know!

cconstab · 2020-10-16T03:48:45Z

Works Perfectly THANK YOU from all of our dev team!

Server viewpoint
Connected from:
SAN: [test.lab.shaduf.com]
CN: null

Ephenodrom · 2020-10-16T07:31:09Z

@cconstab Nice too hear. Feel free to create a issue for feature requests if you have some nice ideas on how to improve this package.

Ephenodrom added a commit that referenced this issue Oct 13, 2020

#31 #28

bfd95a0

cconstab closed this as completed Oct 16, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

X509Utils crash when cert has no CN but a SAN #28

X509Utils crash when cert has no CN but a SAN #28

cconstab commented Oct 4, 2020

Ephenodrom commented Oct 4, 2020

Ephenodrom commented Oct 9, 2020

cconstab commented Oct 10, 2020

Ephenodrom commented Oct 14, 2020

cconstab commented Oct 14, 2020

cconstab commented Oct 16, 2020

Ephenodrom commented Oct 16, 2020

X509Utils crash when cert has no CN but a SAN #28

X509Utils crash when cert has no CN but a SAN #28

Comments

cconstab commented Oct 4, 2020

Ephenodrom commented Oct 4, 2020

Ephenodrom commented Oct 9, 2020

cconstab commented Oct 10, 2020

Ephenodrom commented Oct 14, 2020

cconstab commented Oct 14, 2020

cconstab commented Oct 16, 2020

Ephenodrom commented Oct 16, 2020