Net-SSLeay-1.68 : request informations / $arg_hash->{SSL_ca}

[nicolas2k]

Hello

I found not anywhere of a detail documentation clear about SSL_key or SSL_ca from variables and without from flat files : eg : my-ca.pem or client-cert.pem.

So, I’d like just use by variables a key of CA public without file of "$certdir/my-ca.pem" and open a new socket :

Example of perl 5.14.2 (strawberry 32bits):
$ca_key = q{-----BEGIN CERTIFICATE-----
MIIE+DCCA …. blabla …. tZPMIxRNeUKRg==
-----END CERTIFICATE-----};

$x509 = PEM_string2cert($ca_key); #=> it's work !

if(!($socket = IO::Socket::SSL->new(
Listen => 5,
LocalPort => $port,
Proto => 'tcp',
Reuse => 0,
SSL_ca_path => $certdir,
# SSL_ca_file => "$certdir/my-ca.pem", => it's work fine with all keys
SSL_ca => $x509,
SSL_cert_file => "$certdir/server-cert.pem",
SSL_key_file => "$certdir/server-key.pem",
SSL_use_cert => 1,
SSL_verify_mode => SSL_VERIFY_PEER,
SSL_reuse_ctx => 0,
SSL_server => 1,
SSL_version => 'SSLv3',
SSL_cipher_list => 'SHA:AES:3DES:!RC4:!MD5',
SSL_passwd_cb => sub {return "$secret"},
)) )

And I've some erro :
DB<2>
Can't use string ("61536080") as an ARRAY ref while "strict refs" in use at E:/strawberry-5.14.2.1-32bit/perl/site/lib/IO/Socket/SSL.pm line 2273.
at E:/strawberry-5.14.2.1-32bit/perl/site/lib/IO/Socket/SSL.pm line 2273
IO::Socket::SSL::SSL_Context::new('IO::Socket::SSL::SSL_Context', 'HASH(0x242df6c)') called at E:/strawberry-5.14.2.1-32bit/perl/site/lib/IO/Socket/SSL.pm line 512

Is it possible and which’s a good practice ?

Many thanks for advance.

Best regards

Nicolas

[noxxi]

from the documentation:

... as an internal representation of a X509* object with SSL_cert ...or as an internal representation of a EVP_PKEY* object with SSL_key

You can get to these presentation by either using Net::SSLeay directly or using the PEM_string2cert and similar function from IO::Socket::SSL::Utils. Same with SSL_ca, where you can give an array of X509* handles.

[nicolas2k]

Sorry, I'm always confused during four hours :
in case :
my %sslarg = (
Listen => 5,
LocalPort => $port,
Proto => 'tcp',
Reuse => 0,
SSL_ca_path => $certdir,
SSL_ca_file => "$certdir/my-ca.pem",
SSL_cert_file => "$certdir/server-cert.pem",
SSL_key_file => "$certdir/server-key.pem",
SSL_use_cert => 1,
SSL_verify_mode => SSL_VERIFY_PEER,
SSL_reuse_ctx => 0,
SSL_server => 1,
SSL_version => 'SSLv3',
SSL_cipher_list => 'SHA:AES:3DES:!RC4:!MD5',
SSL_passwd_cb => sub {return "secret"},
);
if(!($socket = IO::Socket::SSL->new( %sslarg )) )
=> it work fine !

in case :
my $ca_cert= '----BEGIN CERTIFICATE ... (PEM formated)';
my $x509 = PEM_string2cert($ca_cert);
my $x509b = CERT_asHash($x509);
my $x509c = PEM_cert2string($x509);
my $x509d = %$x509c;
my %sslarg = (
Listen => 5,
LocalPort => $port,
Proto => 'tcp',
Reuse => 0,
SSL_ca_path => $certdir,
SSL_ca => $x509, # or other variable
SSL_cert_file => "$certdir/server-cert.pem",
SSL_key_file => "$certdir/server-key.pem",
SSL_use_cert => 1,
SSL_verify_mode => SSL_VERIFY_PEER,
SSL_reuse_ctx => 0,
SSL_server => 1,
SSL_version => 'SSLv3',
SSL_cipher_list => 'SHA:AES:3DES:!RC4:!MD5',
SSL_passwd_cb => sub {return "$info{CODESSL}"},
);
if(!($socket = IO::Socket::SSL->new( %sslarg )) )

It said some error of ARRAY nothing of x509, x509b, x509c and x509d worked.

I find not my mistake of method, and I understood of structure x509.h or x509v3.h ...

What should I put into the variable $arg_hash->{SSL_ca} ?

Thanks indeed

[nicolas2k]

I seem that the section SSL_ca of SSL.pm don’t work correctly, because I’ve check with a method of SSL_key which work very fine :

my $ca_cert= '----BEGIN CERTIFICATE ... (PEM formated)';
my $srv_pkey = '----BEGIN RSA PRIVATE [...]';

my $ctx = Net::SSLeay::CTX_new() or die "ERROR: CTX_new failed";
Net::SSLeay::CTX_set_options($ctx, &Net::SSLeay::OP_ALL);

my $bio_cert = Net::SSLeay::BIO_new(Net::SSLeay::BIO_s_mem()) or die;
Net::SSLeay::BIO_write($bio_cert, $ca_cert) or die "no cert";
my $x509 = Net::SSLeay::PEM_read_bio_X509($bio_cert) or die "no x509 structure";
Net::SSLeay::CTX_use_certificate($ctx, $x509) or die ;
Net::SSLeay::BIO_free($bio_cert);

my $bio_key = Net::SSLeay::BIO_new(Net::SSLeay::BIO_s_mem()) or die;
Net::SSLeay::BIO_write($bio_key, $srv_pkey) or die "no key";
my $evp_pkey = Net::SSLeay::PEM_read_bio_PrivateKey($bio_key,
sub {return "secret"}) or die "no evp_pkey structure";
Net::SSLeay::CTX_use_PrivateKey($ctx, $evp_pkey);
Net::SSLeay::BIO_free($bio_key);

my %sslarg = (
Listen => 5,
LocalPort => $port,
Proto => 'tcp',
Reuse => 0,
SSL_ca_path => $certdir,

SSL_ca => $x509,

SSL_ca_file => "$certdir/my-ca.pem",
SSL_key => $evp_pkey,

SSL_key_file => "$certdir/server-key.pem",

SSL_cert_file => "$certdir/server-cert.pem",
SSL_use_cert => 1,
SSL_verify_mode => SSL_VERIFY_PEER,
SSL_reuse_ctx => 0,
SSL_server => 1,
SSL_version => 'SSLv3',
SSL_cipher_list => 'SHA:AES:3DES:!RC4:!MD5',
SSL_passwd_cb => sub {return "secret"},
);

if(!($socket = IO::Socket::SSL->new( %sslarg )) )
{
print ("unable to create socket: ", &IO::Socket::SSL::errstr, "\n");
warn "unable to create socket: ", &IO::Socket::SSL::errstr, "\n";
exit(0);
}

Thanks your assistance

[noxxi]

I'm really confused of what you are doing, which is caused by both bad formatting and bad problem description. Please provide a fully working and minimal example with nicely intended code (see help for how to format your messages in a readable way). Also, SSL_ca needs a list of X509* objects (as documented) and not a single object.

[nicolas2k]

I've sent you mail (xxx at cpan) and I'm sorry that my language is not very well.

So, I've tested and I've modified .\site\lib\IO\Socket\SSL.pm at 2272 this :
my $store = Net::SSLeay::CTX_get_cert_store($ctx);
# for (@{$arg_hash->{SSL_ca}})
{
# Net::SSLeay::X509_STORE_add_cert($store,$_) or
Net::SSLeay::X509_STORE_add_cert($store,$arg_hash->{SSL_ca}) or return IO::Socket::SSL->error(
"Failed to add certificate to CA store");
}

And they now work fine : SSL_ca as SSL_key. But I don't find an alternative for a variable of $x509 of before correction.

Thanks

[noxxi]

What you did it is to change the code, so that it uses a single X509* object as the CA list. But the documentation states for a reason that you should give a list of X509* objects, because usually you have not a single CA but multiple (browsers have 100+). Instead your usage is wrong and you should use a list, i.e.

   SSL_ca => [ $x509 ]

[nicolas2k]

Hi,

ok, Thanks very much but I make two mistakes :

• [] : array of course but
• I've mean a list of x509 this one :
  DB<22> x $x509b
  0 HASH(0x398c23c)
  'crl_uri' => ARRAY(0x398868c)
  empty array
  'ext' => ARRAY(0x398cddc)
  0 HASH(0x39887ac)
  'critical' => 0
  'data' => 'xx:xx:xx:xx:xx:xx:xx:xx:xx'
  'nid' => 82
  'oid' => 'X509v3 Subject Key Identifier'
  'sn' => 'subjectKeyIdentifier'
  1 HASH(0x3992a8c)
  'critical' => 0
  'data' => 'xx:xx:xx:xx:xx:xx:xx:xx:xx'
  DirName:/C=FR/ST=PARIS/L=xx/O=xx/OU=xx/CN=xx/name=xx/emailAddress=xx
  serial:xx:xx:xx:xx:xx:xx:xx:xx:xx
  'nid' => 90
  'oid' => 'X509v3 Authority Key Identifier'
  'sn' => 'authorityKeyIdentifier'
  2 HASH(0x398bd84)
  'critical' => 1
  'data' => 'CA:TRUE'
  'nid' => 87
  'oid' => 'X509v3 Basic Constraints'
  'sn' => 'basicConstraints'
  3 HASH(0x3992b8c)

Thanks,
They work all fine !

[noxxi]

I've updated the documentation to make it more clear which kind of objects are expected and how to get them.