<div dir="ltr">Old thread...maybe you got it sorted already, but this looks similar (but not identical) to some encoding errors I have seen from older versions of Node, OpenSSL, and other libraries where you will randomly generate a certificate with improper padding on a field or two (My guess is it happens about 1% of the time). The fix is to regenerate the certificate (preferably after updating the library used to generate it). <br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Aug 18, 2020 at 11:49 AM Nate Klingenstein <<a href="mailto:ndk@sudonym.me" target="_blank">ndk@sudonym.me</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>All,</div><div><br></div><div>I'm trying to help out a SAMLtest user who's hitting this weird error that I've only seen mentioned once on the list which was obviously bum metadata. This is a homegrown IdP.</div><div><br></div><div>The error:</div><div><br></div>2020-08-18 18:30:49 DEBUG OpenSAML.MessageDecoder.SAML2 [1] [default]: message from (<a href="http://academiaback-sb.eba-4vfkg3f2.us-west-1.elasticbeanstalk.com/sso/metadata/369550" target="_blank">http://academiaback-sb.eba-4vfkg3f2.us-west-1.elasticbeanstalk.com/sso/metadata/369550</a>)<br>2020-08-18 18:30:49 DEBUG OpenSAML.MessageDecoder.SAML2 [1] [default]: searching metadata for message issuer...<br>2020-08-18 18:30:49 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [1] [default]: evaluating message flow policy (replay checking on, expiration 60)<br>2020-08-18 18:30:49 DEBUG XMLTooling.StorageService [1] [default]: inserted record (_69742d45-82a1-4b4d-90dd-3b8795addf9c) in context (MessageFlow) with expiration (1597775689)<br>2020-08-18 18:30:49 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [1] [default]: validating signature profile<br>2020-08-18 18:30:49 DEBUG XMLTooling.KeyInfoResolver.Inline [1] [default]: resolving ds:X509Certificate<br>2020-08-18 18:30:49 DEBUG XMLTooling.KeyInfoResolver.Inline [1] [default]: resolved 1 certificate(s)<br>2020-08-18 18:30:49 DEBUG XMLTooling.KeyInfoResolver.Inline [1] [default]: resolved 0 CRL(s)<br>2020-08-18 18:30:49 DEBUG XMLTooling.KeyInfoResolver.Inline [1] [default]: resolving ds:X509Certificate<br>2020-08-18 18:30:49 ERROR XMLTooling.KeyInfoResolver.Inline [1] [default]: caught XML-Security exception loading certificate: OpenSSL:X509 - Error translating Base64 DER encoding into OpenSSL X509 structure<br><br><div><br></div><div>The metadata:</div><div><br></div><div><EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" ID="AdrianIdP" xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#" target="_blank">http://www.w3.org/2000/09/xmldsig#</a>" xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:xml="<a href="http://www.w3.org/XML/1998/namespace" target="_blank">http://www.w3.org/XML/1998/namespace</a>" xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" entityID="<a href="http://academiaback-sb.eba-4vfkg3f2.us-west-1.elasticbeanstalk.com/sso/metadata/369550" target="_blank">http://academiaback-sb.eba-4vfkg3f2.us-west-1.elasticbeanstalk.com/sso/metadata/369550</a>"><br> <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0"><br><br> <Extensions><br><br><!-- Display information about this IdP that can be used by SP's and discovery<br>services to identify the IdP meaningfully for end users --><br> <mdui:UIInfo><br> <mdui:DisplayName xml:lang="en">Adrian IdP</mdui:DisplayName><br> <mdui:Description xml:lang="en">Adrian IdP</mdui:Description><br> </mdui:UIInfo><br> </Extensions><br><br> <KeyDescriptor use="signing"><br> <ds:KeyInfo><br> <ds:X509Data><br> <ds:X509Certificate><br>MIIDVjCCAj4CCQDwnBv3pZDwWjANBgkqhkiG9w0BAQsFADBtMQswCQYDVQQGEwJV<br>UzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEQ<br>MA4GA1UECgwHSmFua3lDbzEfMB0GA1UEAwwWVGVzdCBJZGVudGl0eSBQcm92aWRl<br>cjAeFw0yMDA4MTAyMjI0MzdaFw00MDA4MDUyMjI0MzdaMG0xCzAJBgNVBAYTAlVT<br>MRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMRAw<br>DgYDVQQKDAdKYW5reUNvMR8wHQYDVQQDDBZUZXN0IElkZW50aXR5IFByb3ZpZGVy<br>MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvG+htArukq2gwPJf+t4k<br>L4kMiZIHF10EEfJF7HqG66ZoTqgprOvenw+mwWQOEM0nwWyBmOAQ1itMGzLp5R6h<br>Mde/kmfi9m3jB06TnlsA5sXrHwTECAhinNNoLZO8h4iSB+mLYNFJ0ad5GUTM3Xzb<br>fSmkw4r/r5XOtou9K/1dNyehYZ5WJ1B/9mKnHsvcGZToHv23RSjRevVsudSt2XsL<br>J7nrP0jrpjiCssxvUaao6rXhWwJrGGGLXloAB2tXT+B3pqkMGcJ8E34RelN/6/d8<br>HHnycpaZxCdcWzG8K140XVeSrtVIAjT+soYiP6GGNjaav+CJcXOIGMauRm6GgpyD<br>+QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQANJWWcBKJM/cNEgXKCGlNrJIbT+xVM<br>pJh+0OPawSjOM2UA0Kw21yxvPDEQDlfeBAxpi5JIpznNY7ArkpOIIsyItlgBxNXB<br>pkqmaXt4B6o2gXoaut7jYtiCkd1G77JvppCtsNWj1Ozzl9h9KsNnS35kz51qkrMR<br>CJh7L/t+U240S7IroHJGdcnpnkGGlrasjn51JTan8MHwWpg2Dm1qsfXrwYQQzw4W<br>NTFENRY6DUCV7Y37075oT1LvQe+cHzE3JWbTNr39MqvNzcszQzJE9gzdbhv84iNi<br>kX5bp/KC3XPfW1Jgyf64KiVCcCFfNJ/HNKgQFqWGhtrs8mSdTWO51xsJ<br> </ds:X509Certificate><br> </ds:X509Data><br> </ds:KeyInfo><br><br> </KeyDescriptor><br><br> <KeyDescriptor use="encryption"><br> <ds:KeyInfo><br> <ds:X509Data><br> <ds:X509Certificate><br>MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC8b6G0Cu6SraDA8l/63iQviQyJkgcXXQQR8kXseobrpmhOqCms696fD6bBZA4QzSfBbIGY4BDWK0wbMunlHqEx17+SZ+L2beMHTpOeWwDmxesfBMQICGKc02gtk7yHiJIH6Ytg0UnRp3kZRMzdfNt9KaTDiv+vlc62i70r/V03J6FhnlYnUH/2Yqcey9wZlOge/bdFKNF69Wy51K3Zewsnues/SOumOIKyzG9RpqjqteFbAmsYYYteWgAHa1dP4HemqQwZwnwTfhF6U3/r93wcefJylpnEJ1xbMbwrXjRdV5Ku1UgCNP6yhiI/oYY2Npq/4Ilxc4gYxq5GboaCnIP5AgMBAAECggEAfDeSfx8due9fIxIjlzpM3FEZxK5QomQcxL/SvFrhCgK+i+tq3aT3Mh+dK6sLYqP66xTeMaqzLpuIJf3gFbulQzgX/ykggpZZrH1t7lvLMlWR8vavSyRL7VmnOTREeYvbx/96c65DXUNrHu8tpWwjPFTxWj4M4vB8PfXMFG2Gv03swvmUfcXgczll8R0j4wmeDpznP6lSc1rhKcc57byNyKv23FsxxABNYvcc7IA2vVNUp6TtVVeYX3lcipCRsT9j0WBUrzvVp5/tMrgkdp7RVmZdR3Ol1FxaOh07RhVviooTm/fqy2AmuFywwDyUyY/FFgHJWtK8PBN6PhswiIB16QKBgQDl4tkosF6Y6HNcouFksoNN+RkqcAT+qOStpcLYw32JYCzA4wMl4MQBrAi4NsFxQqJdQqSiN+kkKk+0diiubbdoyQ8b0ncyTpk9XdyzOd++aQsgC5aqT/EGM2bsjJheA+kY4YgzX4zt1z1Ts2ZzsTjxbdrBNsy8AFGB+ORhr8DPLwKBgQDR12dy5LWjKeSSCgfBxLuID8K9Ot4+bSfRXG5wsBP62FuqVDOUf5RUESGmOyjkkd3RXysjZT8vzc/8lz0cnMzWNjyAp1V/rAtOC6CUjTEpjWpqRBqg9nT9q7xqUb85+7/PdoFE6/mUG1ILU96yfM9m5SnHQPGt6tT3GtfWUozVVwKBgHyLpD9JHlcVSLrde+OEW2L5G8tEGVCmzA3QCnpJn0+4DUcLNn9lAIwvWiIDeFYWVcTVAEDqraLsUXZhtbSauI1KsKbQJcfZkWgP3Cw1pKSSYHaiEKSA3wIPAyoRGdOFptnWBmZe1AlfXVhlj5IKZ+FVNPkM6WrJeV9DKuhJwdn9AoGBAITUcpKC/gt7wElFeiWJMCBvwZjhQ7+GfzcC6JICk5MtE9FdHY15uN4CPieouTj+sMgRExCDzZyoDmlZHwEWrH9Is8HIqtF3iWxs5chDHASulNcRpz2O5P2SkWFHv+GnX4KnBCspqMG9DZFIFOctJGiA1ZJgpNuvlAGbh1cOyEFfAoGAFp+VfAfOkrD+093NF1RxscteCXswEKwZ4swpQoVOKcEdLcvJC3QEbiyKb8YsZ+kTW6liAPlaYqukNUE3ibjgOxVOOn7Fn5Onadf1rZBQre6RycB1T8i+L2dE5MEYgkpb7ZOozoHSUdJtMBZPuJgu9XET4QfDYlCZGH07dKeIUaI=<br> </ds:X509Certificate><br> </ds:X509Data><br> </ds:KeyInfo><br><br> </KeyDescriptor><br><br> <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="<a href="http://academiaback-sb.eba-4vfkg3f2.us-west-1.elasticbeanstalk.com/sso/SingleLogoutService/369550" target="_blank">http://academiaback-sb.eba-4vfkg3f2.us-west-1.elasticbeanstalk.com/sso/SingleLogoutService/369550</a>"/><br> <!-- <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat> --><br> <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="<a href="http://academiaback-sb.eba-4vfkg3f2.us-west-1.elasticbeanstalk.com/sso/SingleSignOnService/369550" target="_blank">http://academiaback-sb.eba-4vfkg3f2.us-west-1.elasticbeanstalk.com/sso/SingleSignOnService/369550</a>"/><br><br> </IDPSSODescriptor><br><br></EntityDescriptor><br></div><div><br></div><div>When I use OpenSSL from the command line(openssl x509 -in /opt/adrian.crt -text) the signature certificate passes through just fine. It chokes on the encryption certificate with:</div><div><br></div><div>unable to load certificate<br>140460810819472:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:tasn_dec.c:1220:<br>140460810819472:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:386:Type=X509_CINF<br>140460810819472:error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error:tasn_dec.c:720:Field=cert_info, Type=X509<br>140460810819472:error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib:pem_oth.c:83:<br></div><div><br></div><div>But I would have expected that to throw an error later on in assertion decryption.</div><div><br></div><div>Anyone have any guesses?</div><div><br></div><div>Thanks in advance,</div><div>Nate.</div></div>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br clear="all"><br>-- <br><div dir="ltr"><div dir="ltr"><div><div dir="ltr"><div>Matt MacAdam</div><div>Senior Developer Support Engineer</div><div>Auth0 (Bellevue, USA, Pacific Time)<br></div></div></div></div></div>