ocsp.check() ends with 'Error: Invalid signature'
- Dominant language
- JavaScript
- Stars
- 86
- Forks
- 46
- PR merge metrics
- No merged PRs in 30d
Description
hello,
i read some of the issues about 'invalid signatures' in this repository and couldn't relate my problem with one of them. maybe i misread something or so. well, i wrote the following piece of code (running snippet):
```
const express = require('express');
const fs = require('fs');
const https = require('https');
const path = require('path');
const app = express();
const ocsp = require("ocsp");
const opts = {
key: fs.readFileSync(path.join(__dirname, '../CA/server/server_key.pem')),
cert: fs.readFileSync(path.join(__dirname, '../CA/server/server_cert.pem')),
ca: [ fs.readFileSync(path.join(__dirname, '../CA/cacert.pem')) ],
requestCert: true,
rejectUnauthorized: false,
};
var server = https.createServer(opts, app);
server.on("secureConnection", function (sock) {
const cert = sock.getPeerCertificate(true);
const rawCert = cert.raw;
const rawIssuer = cert.issuerCertificate.raw;
console.log(rawCert);
console.log(rawIssuer);
ocsp.check({cert: rawCert, issuer: rawIssuer}, function(err, res) {
if(err) {
console.dir(err);
} else {
console.dir(res);
}
});
});
server.listen(443, () => {
console.log(`SERVER ONLINE at https://0.0.0.0:443`);
});
```
this little program opens a https socket and on a secured connection it gets the client certificate via sock.getPeerCertificate(). with ocsp.check() and the derived raw certs of client and issuer i run into this error.
```
SERVER ONLINE at https://0.0.0.0:443
Error: Invalid signature
at Object.verify (/opt/secureclient/node_modules/ocsp/lib/ocsp/verify.js:81:17)
at /opt/secureclient/node_modules/ocsp/lib/ocsp/check.js:38:12
at done (/opt/secureclient/node_modules/ocsp/lib/ocsp/utils.js:26:7)
at IncomingMessage. (/opt/secureclient/node_modules/ocsp/lib/ocsp/utils.js:46:7)
at IncomingMessage.emit (events.js:194:15)
at endReadableNT (_stream_readable.js:1103:12)
at process._tickCallback (internal/process/next_tick.js:63:19)
```
the ocsp server is the plain openssl ocsp server, which get launched like this:
`openssl ocsp -index index.txt -port 8888 -rsigner server/signer.pem -CA cacert.pem -text -out log.txt`
what signature is checked in verify.js line 81? and how can i get it work? do you need any further information?
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the failing path in lib/ocsp/verify.js at line 81 and follow its caller in lib/ocsp/check.js at line 38. Reproduce the issue using the provided HTTPS server, client and issuer certificate buffers with the OpenSSL OCSP command, then determine which signature verification input is rejected. Done means the cause is documented and the check either succeeds for valid certificates or reports the correct failure.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100