[sr #107540] iPhone/iPad TLS negotiation to postfix fails with certtool certs, works with openssl certs

[Nikos Mavrogiannopoulos]

It might be that apple is correct here, and gnutls doesn't encode
properly. I see that only on ECDSA the parameters field must be ommited
while on RSA the parameters shall be of NULL type. Thus I'd handle this
as a bug on gnutls' side and commit a fix. Thank you for bringing that
to our attention!

regards,
Nikos


On 12/05/2010 03:29 PM, Michael Rommel wrote:
> Hi Nikos,
> 
> doing the same patch you suggested in a second location:
> 
> Line 1181 in lib/x509/common.c
> 
>       /* result = asn1_write_value (dst, name, NULL, 0); */
>       result = asn1_write_value (dst, name, "\x05\x00", 2);
> 
> did do the trick. Now the certificate is accepted and displayed for acceptance. I'll update the info as soon as savannah is reachable again, the last hour or so, no connection was possible.
> 
> Can you please give me a little bit more information, where I can find out more about the correct parameters?
> 
> RFC3279 states:
> The ASN.1 object identifier used to identify this signature algorithm
>    is:
> 
>       sha-1WithRSAEncryption OBJECT IDENTIFIER  ::=  {
>           iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
>           pkcs-1(1) 5  }
> 
>    When any of these three OIDs appears within the ASN.1 type
>    AlgorithmIdentifier, the parameters component of that type SHALL be
>    the ASN.1 type NULL.
> 
>    The RSA signature generation process and the encoding of the result
>    is described in detail in PKCS #1 [RFC 2313].
> So it is a SHOULD. But can you leave it out or what can you do, when you don't want to follow the SHOULD route?
> 
> I'd try to take the info to the openssl team and Apple because it would be their part now... But if the behaviour is not defined how to handle the non-SHOULD way it would make it difficult.
> 
> What's you opinion on that?
> 
> Thanks a lot!
> 
>   Michael.
> 
> 
> On 5. Dec 2010, at 11:20 , Nikos Mavrogiannopoulos wrote:
> 
>>
>> Follow-up Comment #7, sr #107540 (project gnutls):
>>
>> Could you try the attached patch, on whether generates certificates that are
>> accepted by the devices?
>>
>> (file #22126)
>>    _______________________________________________________
>>
>> Additional Item Attachment:
>>
>> File name: patch.txt                      Size:0 KB
>>
>>
>>    _______________________________________________________
>>
>> Reply to this item at:
>>
>>  <http://savannah.gnu.org/support/?107540>
>>
>> _______________________________________________
>>  Message sent via/by Savannah
>>  http://savannah.gnu.org/
>>
>