[JIRA] (MDA-270) Supply more detail on unconvertable X.509 certificates

[Ian Young (Jira)]

Ian Young ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3Ae127cb03-43ed-473d-b6ba-592949cb4be8 ) *created* an issue

Metadata Aggregator ( https://shibboleth.atlassian.net/browse/MDA?atlOrigin=eyJpIjoiMWViZmYwMmRlOGJhNGE5ZTkzNDMzNmZkNTk1MGFhMmQiLCJwIjoiaiJ9 ) / Improvement ( https://shibboleth.atlassian.net/browse/MDA-270?atlOrigin=eyJpIjoiMWViZmYwMmRlOGJhNGE5ZTkzNDMzNmZkNTk1MGFhMmQiLCJwIjoiaiJ9 ) MDA-270 ( https://shibboleth.atlassian.net/browse/MDA-270?atlOrigin=eyJpIjoiMWViZmYwMmRlOGJhNGE5ZTkzNDMzNmZkNTk1MGFhMmQiLCJwIjoiaiJ9 ) Supply more detail on unconvertable X.509 certificates ( https://shibboleth.atlassian.net/browse/MDA-270?atlOrigin=eyJpIjoiMWViZmYwMmRlOGJhNGE5ZTkzNDMzNmZkNTk1MGFhMmQiLCJwIjoiaiJ9 )

Issue Type: Improvement Affects Versions: 0.9.2 Assignee: Ian Young ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3Ae127cb03-43ed-473d-b6ba-592949cb4be8 ) Components: Validation Created: 09/Sep/22 5:54 AM Fix Versions: 0.10.0 Priority: Trivial Reporter: Ian Young ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3Ae127cb03-43ed-473d-b6ba-592949cb4be8 )

The X509ValidationStage converts an X.509 certificate expressed as Base64 first to a byte array and then to an X509Certificate object. If either of these operations fails for any reason, the same error status is added: could not convert X509Certficate data.

While true, this is not actually helpful in the case where a purported certificate is unacceptable.

The stage should split the two basic cases, and pass through the detail message at least in the case of a caught CertificateException.

The prompting use case is an eduGAIN entity whose certificate has null issuer and null subject. Java rejects this with Empty issuer DN not allowed in X509Certificates.

While this arguably isn’t a constraint that needs to apply in the case of X.509 certificates wrapping public keys in SAML metadata, most Java code trying to interpret the certificate is going to fail so at the very least it’s a serious potential interoperability issue. I don’t know whether the IdP would face the same issue, but if it did I certainly wouldn’t advocate for dodging the issue by parsing certificates in some other way.

( https://shibboleth.atlassian.net/browse/MDA-270#add-comment?atlOrigin=eyJpIjoiMWViZmYwMmRlOGJhNGE5ZTkzNDMzNmZkNTk1MGFhMmQiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/MDA-270#add-comment?atlOrigin=eyJpIjoiMWViZmYwMmRlOGJhNGE5ZTkzNDMzNmZkNTk1MGFhMmQiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100206- sha1:d8a7a40 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220909/a22bfe8b/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-5ee8aa4d-64fc-4594-b2f9-87386fb17e63
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220909/a22bfe8b/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-3bca593e-bb06-435c-8a3d-3ddb3093f00c
Type: image/png
Size: 457 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220909/a22bfe8b/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-5676d284-a912-4255-875a-81eda892c038
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220909/a22bfe8b/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-b800266b-bf9f-4072-933b-33adc8722d3f
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220909/a22bfe8b/attachment-0007.png>