Incorrect version in self signed certificate

[donovanhide]

https://github.com/ripple/rippled/blob/9d89d4c1885e13e3c0aa7cdb4a389c6fbfd3790a/src/ripple/basics/impl/make_SSLContext.cpp#L159

X.509 certificates can have a version number between 1 and 3 inclusive. The constant NID_X509 equals 12. The correct constants are one of X509_VERSION_1,X509_VERSION_2 or X509_VERSION_3. Maybe this is an ancient copy paste error? Anyway, it stops Go's crypto\tls library parsing the certificate, reporting an invalid version.

[donovanhide]

@nbougalis Another one for you?

[donovanhide]

Looks like this might have been the copy paste source :-)

https://stackoverflow.com/questions/2883164/openssl-certificate-lacks-key-identifiers

[donovanhide]

Simplest fix for this is to simply delete the erroneous line above and accept the default version (X509_VERSION_1):

https://www.openssl.org/docs/man3.0/man3/X509_set_version.html

Perhaps this is a good lesson in checking return codes from C functions :-) Want a PR?

[MarkusTeufelberger]

Practically every x509 certificate out there has version 3, please use that if you fix this.

[donovanhide]

https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.1

This field describes the version of the encoded certificate. When
extensions are used, as expected in this profile, version MUST be 3
(value is 2). If no extensions are present, but a UniqueIdentifier
is present, the version SHOULD be 2 (value is 1); however, the
version MAY be 3. If only basic fields are present, the version
SHOULD be 1 (the value is omitted from the certificate as the default
value); however, the version MAY be 2 or 3.

To me, that reads like it should be X509_VERSION_1.

[donovanhide]

Bear in mind that this is only for the self-signed certificate. not the one that can be specified in the configuration file.

https://github.com/ripple/rippled/blob/9d89d4c1885e13e3c0aa7cdb4a389c6fbfd3790a/src/ripple/basics/impl/make_SSLContext.cpp#L268-L283

It is notable that a lot of return codes are ignored in this code section as well.

[MarkusTeufelberger]

 x509_ptr cert = x509_new(); 
 x509_set_pubkey(cert.get(), pkey.get()); 
 x509_sign(cert.get(), pkey.get());

Hngggghhhh...

As the co-author of https://docs.ansible.com/ansible/latest/collections/community/crypto/x509_certificate_module.html this looks a bit... let's call it fast and loose.

Yeah, version 1 or 2 might be possible too, but maybe eventually there's some more advanced TLS functionality used to secure P2P connections - then at least this is one place that doesn't need changing or that one needs to worry about. Version 13 (version values are one-off...) is definitely a bug though that should be fixed.