0
$\begingroup$

I was trying to verify the following JWT on JWT.io with the following public key:

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJFVS5FT1JJLk5MODEyNDU4ODM3IiwiYXVkIjoiRVUuRU9SSS5OTDIxOTA0ODExMyIsImNsaWVudF9pZCI6IkVVLkVPUkkuTkwyMTkwNDgxMTMiLCJleHAiOjE1NjUyNTg1MzEsIm5iZiI6MTU2NTI1NDkzMSwiaWF0IjoxNTY1MjU0OTMxLCJzY29wZSI6WyJpU0hBUkUiXX0.uD3Y0QKQMM6fy3th7ceuFbqHLwsWWfJxK-HvA0cCZL2ZMiRko6tiuyrg7uci5aDIs4qpFsKMzBj_RJLGz3phLp9ViBMfHDav2nPpwkJjXZpUVJ3IFl9HjSlMRo2Ggiizl99GSWk-kIr0nTF8VbWeOY62-y14bJIWxl31JSUezyBc7jKqnDt7dZboO1QaO4oEpbj2YuBKkjJno02vnJX6c4pnfyWdOqe7RWrP_upnV3GdLgWaG2pCBvIPYejqlzQjcwBWZ6TBRanG9sNye-9jn1-4KFMQ_Q_3VV-3Xi97U8RwsyXUEuSq_41J5mT25V1JRSB822lDRqnjysL9HskJMA

Key

-----BEGIN CERTIFICATE-----
MIID8zCCAtugAwIBAgIINUOGwbq0IfAwDQYJKoZIhvcNAQELBQAwPDE6MDgGA1UEAwwxVEVTVCBpU0hBUkUgRVUgSXNzdWluZyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBHNTAeFw0xOTA3MjQxMTQ4MDJaFw0yMTA3MjMxMTQ4MDJaMH8xEDAOBgNVBAMMB0lOTk9QQVkxHDAaBgNVBAUTE0VVLkVPUkkuTkw4MTI0NTg4MzcxFzAVBgNVBAsMDkZ1biBEZXBhcnRtZW50MRMwEQYDVQQKDApJTk5PUEFZIEJWMRIwEAYDVQQHDAlBbXN0ZXJkYW0xCzAJBgNVBAYTAk5MMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyI3mSTlTr3aGACMewLMFomVm3E6OvUku3xjHvNm0Ji/fzkoyLVQLEEVz6mtmEj5W0qYeCBJi+tKxmT+MEBNPc22TFCCtCPxUEov9NEeIK6Ku+GU700Qj3wY1hB/mZqw4JH22jxLOOSU01Vga/GFADF0TuWCVhOu7CJxCy64uuH5IcIB+bdgzwbkoQMQQ5WtKSO3hbI7mNG78akmZ3UDxU4ZkS9NhCamu5PBrdQWc5JWwooENLGBtqTaVXZBRyDoLq4SJ6pr+yKScyMp9LEe/Uc2hUKnoq7G5VpJaEfUehKS3kEbL+6thvsRf0eFz7HcqXMUyETAfcBf336TRG5HIWQIDAQABo4G1MIGyMB8GA1UdIwQYMBaAFG3FZYnL35FU0Ws8twKlLs2KaJAdMCcGA1UdJQQgMB4GCCsGAQUFBwMCBggrBgEFBQcDBAYIKwYBBQUHAwEwNwYIKwYBBQUHAQMEKzApMAgGBgQAjkYBATAIBgYEAI5GAQQwEwYGBACORgEGMAkGBwQAjkYBBgIwHQYDVR0OBBYEFLCpV8Zrw1FYM3jdGpmOVVgkMY0mMA4GA1UdDwEB/wQEAwIGwDANBgkqhkiG9w0BAQsFAAOCAQEAbJ08bV7+zfFsWsjZR106H8bQGCGWOM47KeNi5/qROI0AVWPkSm63OiyYMGFJNxxEdUL8E8Tpkuy7mc5JmvZYOoLNrpb4HH8OAS0Q4EzKNW2uA2LiLWFaokiLGZDJgwEaLHhaFaGrCg2yOu2NdWOeojC23STJ0Jkb4TdySNsd6K8RJ0BeYqSazLU5BJBiWxM4pL5hNNYQa1BWbmWSTFcku+wfcoir+7Lp57IxW0w6MTaJM9tsMlZZ+QMZtTEkcm1QiALxSctdABjf1fylbwrnlievFKFuCzlrlgN+WDVnyAAUgOXirtgRXGzfpJD8lqGXAmAtcesnNxKfrd4eux6Gfg==
-----END CERTIFICATE-----

And it verifies! Nice! However, I was testing if it would still work with some small modifications. For example, if I remove the last three characters from the certificate ('Gfg') it still verifies! Or if I do a small change to some characters in the certificate (i.e. change 'R' to 'S' or '3' to '4') it will also verify.

Why does this happen? Does it have to do with the RS256 algorithm, or with JWT? I would have thought that the certificate-value would have to be very precise in order to verify the private key!

Improve this question
$\endgroup$

1 Answer 1

Reset to default
2
$\begingroup$

The certificate is much more than a public key, changing the public key will of course prevent verification but most of what you did doesn't change that. Your certificate above also has the following information: Common Name: INNOPAY Organization: INNOPAY BV Organization Unit: Fun Department Locality: Amsterdam Country: NL Valid From: July 24, 2019 Valid To: July 23, 2021 Serial Number: 3838059474068972016 (0x354386c1bab421f0)

changing that may make the certificate invalid and invalidate any signatures on it. but Token verification should be unchanged.

Improve this answer
$\endgroup$
2
  • $\begingroup$ Cert Subject also includes serialNumber = EU.EORI.NL812458837, which is not X.500 standard but common and matches the JWT claim. And the last 256 binary bytes of the cert (about the last 341 base64 chars) are the (sha256)RSA-2048 signature on the cert, which can only be checked using the issuer (CA) publickey, which OP doesn't describe providing, and the Issuer name is for a 'test' CA that may not be public and the cert has no AIA or even other URLs that might help a human like OCSPR, CRLDP, Policy ref., $\endgroup$
    – dave_thompson_085
    Aug 8, 2019 at 23:59
  • $\begingroup$ Indeed, this specific certificate is used only for a specific test environment, so it is issued by a test CA with no need for that $\endgroup$
    – Krijn
    Aug 10, 2019 at 19:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.