0
$\begingroup$

Say I have the following signing cert:

-----BEGIN CERTIFICATE-----
MIIB4zCCAUygAwIBAgIUSyCTib61O8k8TM5JA5n3zDYDFs8wDQYJKoZIhvcNAQEF
BQAwHDEaMBgGA1UECgwRcGhwc2VjbGliIGRlbW8gQ0EwIBcNMTcxMjEwMTYxMDIw
WhgPOTk5OTEyMzEyMzU5NTlaMBwxGjAYBgNVBAoMEXBocHNlY2xpYiBkZW1vIENB
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCn5XdGJUd9PY9zpksbJ2kD57PL
nQ3ISK+qbeSe2H+Uj0AEDnm611tvXlr9a7zBPNwZ2ali9bczirQkxtu/sftSHCGv
LL6sz1vdYP0Un792o5h+PkbQLnDe1lf/W8Q87GY9cRxUQVVfA7QUfgsl4iWgi7tv
qz3dRmxzBpjpgWvp/QIDAQABoyAwHjALBgNVHQ8EBAMCAQYwDwYDVR0TAQH/BAUw
AwEB/zANBgkqhkiG9w0BAQUFAAOBgQBQJpF/uakVjNIOz4Ve+duZYeeghpVxVNVK
t4OFi8DQzAsdFBpDDg/ZdAoXYOI/VHwNR+jKS2bPLmvNR2dP+OuZVdSTYu4/dZtI
Tp9ju17bym9oyWjX8CApa32+4N4WtcYLaVHOgyGA9f1VRHBtLTc8xcuHnJg6v3m9
TYVkR8c3IQ==
-----END CERTIFICATE-----

Here's the output of openssl x509 -in mycert.pem -text -noout on that cert:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4b:20:93:89:be:b5:3b:c9:3c:4c:ce:49:03:99:f7:cc:36:03:16:cf
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: O=phpseclib demo CA
        Validity
            Not Before: Dec 10 16:10:20 2017 GMT
            Not After : Dec 31 23:59:59 9999 GMT
        Subject: O=phpseclib demo CA
        Subject Public Key Info:
....
        X509v3 extensions:
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha1WithRSAEncryption
....

And the following signed cert:

-----BEGIN CERTIFICATE-----
MIIB5TCCAU6gAwIBAgIUVCrbYZRButS1ka5fyUe2iOzFAmwwDQYJKoZIhvcNAQEF
BQAwHDEaMBgGA1UECgwRcGhwc2VjbGliIGRlbW8gQ0EwIBcNMTcxMjEwMTYxMDIw
WhgPOTk5OTEyMzEyMzU5NTlaMB4xHDAaBgNVBAoME3BocHNlY2xpYiBkZW1vIGNl
cnQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANkmWIAsKkL1Bv3PiFA65IRQ
EOSc65rui70M5tvrDpka1jl6QgvGY/jI/6D6h8sZBxyYyncgWaCA4dVv9dmdZm8Z
JPXACUfHTJuk7ApPq2oYjyheyQkSLp8kYP47cidbNfWk3RkTRqwleh3ByG4e1Qxh
sfdf5owA1yuW5JSygppvAgMBAAGjIDAeMA4GA1UdIwQHMAWAA3p6ejAMBgNVHQ4E
BQQDenp6MA0GCSqGSIb3DQEBBQUAA4GBACMLNye3bEzTnHJAroAiV8Rw9rL6QG+x
wrFDBq173MXTAnKar/TujUxfmOzNZCxjPHh6oKRosOWZuI5v8/0wG9I6irYwLXOw
kXMvXT91/m5Vk7rLCqQ+zsFncxg12leHRgglWh1wsJOhPI/B0mYgCA04RNHsm+iC
/XjRBlAt1kMb
-----END CERTIFICATE-----

Here's the output of openssl x509 -in mycert.pem -text -noout on this cert:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            54:2a:db:61:94:41:ba:d4:b5:91:ae:5f:c9:47:b6:88:ec:c5:02:6c
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: O=phpseclib demo CA
        Validity
            Not Before: Dec 10 16:10:20 2017 GMT
            Not After : Dec 31 23:59:59 9999 GMT
        Subject: O=phpseclib demo cert
        Subject Public Key Info:
...
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                keyid:7A:7A:7A

            X509v3 Subject Key Identifier:
                7A:7A:7A
    Signature Algorithm: sha1WithRSAEncryption
....

For brevity I've stripped out the "Subject Public Key Info" and "Signature Algorithm" sections from both.

Anyway, note how in the signed cert both the "X509v3 Subject Key Identifier" and the "X509v3 Authority Key Identifier" extensions are present. In the signing cert neither are present.

It seems to me that since the signing cert doesn't have a "X509v3 Subject Key Identifier" while the signed cert does have a "X509v3 Authority Key Identifier" that the cert ought not validate. And yet in OpenSSL it does:

openssl verify -verbose -CAfile signer.pem signed.pem

So who's correct? Is my interpretation correct or is OpenSSL's? Is there any RFC that discusses what the behavior ought to be in this scenario?

| improve this question | |
$\endgroup$
  • $\begingroup$ Note that AKI -- if present at all -- has two options, and only one of them is to copy SKI from the parent; the other is to copy Issuer (not Subject if non-self-signed, there is at least one Q on that) and Serial (both always present) from the parent. $\endgroup$ – dave_thompson_085 Dec 10 '17 at 23:51
3
$\begingroup$

The subject key identifier is not used for validation, it is merely used to help in path building.

Please see RFC 5280 section 4.2.1.2 for more details.

Edit: Use of key identifiers in certificate path building is detailed in RFC 4158 section 3.5.12

| improve this answer | |
$\endgroup$
  • $\begingroup$ It seems like the path ought not be considered build-able if signed cert's authority key identifier doesn't match the signing certs subject key identifier, be it because the subject key identifier is missing all together or because the it's present but different. And if the path can't be built then it seems like the cert ought to fail validation. idk. $\endgroup$ – neubert Dec 10 '17 at 17:58
  • $\begingroup$ The key identifier "helps" build the path but is not required. It cannot be used to eliminate a certificate from the path. You can find some more details about key identifier use in path construction in RFC 4158 section 3.5.12 $\endgroup$ – Marc Dec 10 '17 at 18:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.