Error translating Base64 DER encoding into OpenSSL X509 structure

Fri Sep 4 17:44:45 UTC 2020

Old thread...maybe you got it sorted already, but this looks similar (but
not identical) to some encoding errors I have seen from older versions of
Node, OpenSSL, and other libraries where you will randomly generate a
certificate with improper padding on a field or two (My guess is it happens
about 1% of the time).  The fix is to regenerate the certificate
(preferably after updating the library used to generate it).

On Tue, Aug 18, 2020 at 11:49 AM Nate Klingenstein <ndk at sudonym.me> wrote:

> All,
>
> I'm trying to help out a SAMLtest user who's hitting this weird error that
> I've only seen mentioned once on the list which was obviously bum
> metadata.  This is a homegrown IdP.
>
> The error:
>
> 2020-08-18 18:30:49 DEBUG OpenSAML.MessageDecoder.SAML2 [1] [default]:
> message from (
> http://academiaback-sb.eba-4vfkg3f2.us-west-1.elasticbeanstalk.com/sso/metadata/369550
> )
> 2020-08-18 18:30:49 DEBUG OpenSAML.MessageDecoder.SAML2 [1] [default]:
> searching metadata for message issuer...
> 2020-08-18 18:30:49 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [1]
> [default]: evaluating message flow policy (replay checking on, expiration
> 60)
> 2020-08-18 18:30:49 DEBUG XMLTooling.StorageService [1] [default]:
> inserted record (_69742d45-82a1-4b4d-90dd-3b8795addf9c) in context
> (MessageFlow) with expiration (1597775689)
> 2020-08-18 18:30:49 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [1]
> [default]: validating signature profile
> 2020-08-18 18:30:49 DEBUG XMLTooling.KeyInfoResolver.Inline [1] [default]:
> resolving ds:X509Certificate
> 2020-08-18 18:30:49 DEBUG XMLTooling.KeyInfoResolver.Inline [1] [default]:
> resolved 1 certificate(s)
> 2020-08-18 18:30:49 DEBUG XMLTooling.KeyInfoResolver.Inline [1] [default]:
> resolved 0 CRL(s)
> 2020-08-18 18:30:49 DEBUG XMLTooling.KeyInfoResolver.Inline [1] [default]:
> resolving ds:X509Certificate
> 2020-08-18 18:30:49 ERROR XMLTooling.KeyInfoResolver.Inline [1] [default]:
> caught XML-Security exception loading certificate: OpenSSL:X509 - Error
> translating Base64 DER encoding into OpenSSL X509 structure
>
>
> The metadata:
>
> <EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
> ID="AdrianIdP" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
> xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:xml="
> http://www.w3.org/XML/1998/namespace"
> xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" entityID="
> http://academiaback-sb.eba-4vfkg3f2.us-west-1.elasticbeanstalk.com/sso/metadata/369550
> ">
>     <IDPSSODescriptor
> protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol
> urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0">
>
>         <Extensions>
>
> <!-- Display information about this IdP that can be used by SP's and
> discovery
> services to identify the IdP meaningfully for end users -->
>             <mdui:UIInfo>
>                 <mdui:DisplayName xml:lang="en">Adrian
> IdP</mdui:DisplayName>
>                 <mdui:Description xml:lang="en">Adrian
> IdP</mdui:Description>
>             </mdui:UIInfo>
>         </Extensions>
>
>         <KeyDescriptor use="signing">
>             <ds:KeyInfo>
>                     <ds:X509Data>
>                         <ds:X509Certificate>
> MIIDVjCCAj4CCQDwnBv3pZDwWjANBgkqhkiG9w0BAQsFADBtMQswCQYDVQQGEwJV
> UzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEQ
> MA4GA1UECgwHSmFua3lDbzEfMB0GA1UEAwwWVGVzdCBJZGVudGl0eSBQcm92aWRl
> cjAeFw0yMDA4MTAyMjI0MzdaFw00MDA4MDUyMjI0MzdaMG0xCzAJBgNVBAYTAlVT
> MRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMRAw
> DgYDVQQKDAdKYW5reUNvMR8wHQYDVQQDDBZUZXN0IElkZW50aXR5IFByb3ZpZGVy
> MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvG+htArukq2gwPJf+t4k
> L4kMiZIHF10EEfJF7HqG66ZoTqgprOvenw+mwWQOEM0nwWyBmOAQ1itMGzLp5R6h
> Mde/kmfi9m3jB06TnlsA5sXrHwTECAhinNNoLZO8h4iSB+mLYNFJ0ad5GUTM3Xzb
> fSmkw4r/r5XOtou9K/1dNyehYZ5WJ1B/9mKnHsvcGZToHv23RSjRevVsudSt2XsL
> J7nrP0jrpjiCssxvUaao6rXhWwJrGGGLXloAB2tXT+B3pqkMGcJ8E34RelN/6/d8
> HHnycpaZxCdcWzG8K140XVeSrtVIAjT+soYiP6GGNjaav+CJcXOIGMauRm6GgpyD
> +QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQANJWWcBKJM/cNEgXKCGlNrJIbT+xVM
> pJh+0OPawSjOM2UA0Kw21yxvPDEQDlfeBAxpi5JIpznNY7ArkpOIIsyItlgBxNXB
> pkqmaXt4B6o2gXoaut7jYtiCkd1G77JvppCtsNWj1Ozzl9h9KsNnS35kz51qkrMR
> CJh7L/t+U240S7IroHJGdcnpnkGGlrasjn51JTan8MHwWpg2Dm1qsfXrwYQQzw4W
> NTFENRY6DUCV7Y37075oT1LvQe+cHzE3JWbTNr39MqvNzcszQzJE9gzdbhv84iNi
> kX5bp/KC3XPfW1Jgyf64KiVCcCFfNJ/HNKgQFqWGhtrs8mSdTWO51xsJ
>                         </ds:X509Certificate>
>                     </ds:X509Data>
>             </ds:KeyInfo>
>
>         </KeyDescriptor>
>
>         <KeyDescriptor use="encryption">
>             <ds:KeyInfo>
>                     <ds:X509Data>
>                         <ds:X509Certificate>
>
> MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC8b6G0Cu6SraDA8l/63iQviQyJkgcXXQQR8kXseobrpmhOqCms696fD6bBZA4QzSfBbIGY4BDWK0wbMunlHqEx17+SZ+L2beMHTpOeWwDmxesfBMQICGKc02gtk7yHiJIH6Ytg0UnRp3kZRMzdfNt9KaTDiv+vlc62i70r/V03J6FhnlYnUH/2Yqcey9wZlOge/bdFKNF69Wy51K3Zewsnues/SOumOIKyzG9RpqjqteFbAmsYYYteWgAHa1dP4HemqQwZwnwTfhF6U3/r93wcefJylpnEJ1xbMbwrXjRdV5Ku1UgCNP6yhiI/oYY2Npq/4Ilxc4gYxq5GboaCnIP5AgMBAAECggEAfDeSfx8due9fIxIjlzpM3FEZxK5QomQcxL/SvFrhCgK+i+tq3aT3Mh+dK6sLYqP66xTeMaqzLpuIJf3gFbulQzgX/ykggpZZrH1t7lvLMlWR8vavSyRL7VmnOTREeYvbx/96c65DXUNrHu8tpWwjPFTxWj4M4vB8PfXMFG2Gv03swvmUfcXgczll8R0j4wmeDpznP6lSc1rhKcc57byNyKv23FsxxABNYvcc7IA2vVNUp6TtVVeYX3lcipCRsT9j0WBUrzvVp5/tMrgkdp7RVmZdR3Ol1FxaOh07RhVviooTm/fqy2AmuFywwDyUyY/FFgHJWtK8PBN6PhswiIB16QKBgQDl4tkosF6Y6HNcouFksoNN+RkqcAT+qOStpcLYw32JYCzA4wMl4MQBrAi4NsFxQqJdQqSiN+kkKk+0diiubbdoyQ8b0ncyTpk9XdyzOd++aQsgC5aqT/EGM2bsjJheA+kY4YgzX4zt1z1Ts2ZzsTjxbdrBNsy8AFGB+ORhr8DPLwKBgQDR12dy5LWjKeSSCgfBxLuID8K9Ot4+bSfRXG5wsBP62FuqVDOUf5RUESGmOyjkkd3RXysjZT8vzc/8lz0cnMzWNjyAp1V/rAtOC6CUjTEpjWpqRBqg9nT9q7xqUb85+7/PdoFE6/mUG1ILU96yfM9m5SnHQPGt6tT3GtfWUozVVwKBgHyLpD9JHlcVSLrde+OEW2L5G8tEGVCmzA3QCnpJn0+4DUcLNn9lAIwvWiIDeFYWVcTVAEDqraLsUXZhtbSauI1KsKbQJcfZkWgP3Cw1pKSSYHaiEKSA3wIPAyoRGdOFptnWBmZe1AlfXVhlj5IKZ+FVNPkM6WrJeV9DKuhJwdn9AoGBAITUcpKC/gt7wElFeiWJMCBvwZjhQ7+GfzcC6JICk5MtE9FdHY15uN4CPieouTj+sMgRExCDzZyoDmlZHwEWrH9Is8HIqtF3iWxs5chDHASulNcRpz2O5P2SkWFHv+GnX4KnBCspqMG9DZFIFOctJGiA1ZJgpNuvlAGbh1cOyEFfAoGAFp+VfAfOkrD+093NF1RxscteCXswEKwZ4swpQoVOKcEdLcvJC3QEbiyKb8YsZ+kTW6liAPlaYqukNUE3ibjgOxVOOn7Fn5Onadf1rZBQre6RycB1T8i+L2dE5MEYgkpb7ZOozoHSUdJtMBZPuJgu9XET4QfDYlCZGH07dKeIUaI=
>                         </ds:X509Certificate>
>                     </ds:X509Data>
>             </ds:KeyInfo>
>
>         </KeyDescriptor>
>
>     <SingleLogoutService
> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="
> http://academiaback-sb.eba-4vfkg3f2.us-west-1.elasticbeanstalk.com/sso/SingleLogoutService/369550
> "/>
>     <!--
> <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
> -->
>     <SingleSignOnService
> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="
> http://academiaback-sb.eba-4vfkg3f2.us-west-1.elasticbeanstalk.com/sso/SingleSignOnService/369550
> "/>
>
>     </IDPSSODescriptor>
>
> </EntityDescriptor>
>
> When I use OpenSSL from the command line(openssl x509 -in /opt/adrian.crt
> -text) the signature certificate passes through just fine.  It chokes on
> the encryption certificate with:
>
> unable to load certificate
> 140460810819472:error:0D0680A8:asn1 encoding
> routines:ASN1_CHECK_TLEN:wrong tag:tasn_dec.c:1220:
> 140460810819472:error:0D07803A:asn1 encoding
> routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:386:Type=X509_CINF
> 140460810819472:error:0D08303A:asn1 encoding
> routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1
> error:tasn_dec.c:720:Field=cert_info, Type=X509
> 140460810819472:error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1
> lib:pem_oth.c:83:
>
> But I would have expected that to throw an error later on in assertion
> decryption.
>
> Anyone have any guesses?
>
> Thanks in advance,
> Nate.
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>

-- 
Matt MacAdam
Senior Developer Support Engineer
Auth0 (Bellevue, USA, Pacific Time)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200904/e48f25c0/attachment.htm>