"unknown signature algorithm" when trying to verify a certificate based on ECC key
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 276
- Forks
- 200
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 7
Description
Hi everyone, I don't know much about SSL understanding and I have a question because I try to verify a certifcate.
I hope someone can help me and/or maybe guide me to a solution.
Context occurs on a process of strong user authentication where I can receive either an old certificate or a new one. My code has to work with both of them.
I think I have to verify the signature of a certificate to provide this strong integrity.
I don't have any issue with the old certificate which is based on RSA Keys, but I got one with the new certificate where it is an ECC key.
At the moment I have no choice but to bypass the check on the new certificate.
The old certificate has the following lines in it (I have omitted some lines) :
Certificate:
Data:
Version: 3 (0x2)
Signature Algorithm: sha256WithRSAEncryption
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (2048 bit)
Modulus:
-----
Exponent: 65537 (0x10001)
The new certificate has the following lines in it :
Certificate:
Data:
Version: 3 (0x2)
Signature Algorithm: rsassaPss
Hash Algorithm: sha256
Mask Algorithm: mgf1 with sha256
Salt Length: 0x20
Trailer Field: 0xBC (default)
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (256 bit)
pub:
--------
ASN1 OID: prime256v1
NIST CURVE: P-256
I usually execute the following command to verify the certificate : signer_certificate.verify(certificate.public_key)
I get unknown signature algorithm when I try to use this command on the new certificate.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the reported signer_certificate.verify(certificate.public_key) call and compare the RSA certificate details with the ECC certificate details in the issue. Trace how the Ruby OpenSSL binding handles the rsassaPss signature algorithm and id-ecPublicKey key, then reproduce the unknown signature algorithm error. Done means the reported certificate verification path no longer rejects this algorithm unexpectedly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ruby
- Domain
- cryptography, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100