{"action":"created","issue":{"url":"https://api.github.com/repos/mpeylo/cmpossl/issues/133","repository_url":"https://api.github.com/repos/mpeylo/cmpossl","labels_url":"https://api.github.com/repos/mpeylo/cmpossl/issues/133/labels{/name}","comments_url":"https://api.github.com/repos/mpeylo/cmpossl/issues/133/comments","events_url":"https://api.github.com/repos/mpeylo/cmpossl/issues/133/events","html_url":"https://github.com/mpeylo/cmpossl/issues/133","id":318904192,"number":133,"title":"PKI enrollment signature verification failure - question","user":{"login":"mikejhathaway","id":38565146,"avatar_url":"https://avatars1.githubusercontent.com/u/38565146?v=4","gravatar_id":"","url":"https://api.github.com/users/mikejhathaway","html_url":"https://github.com/mikejhathaway","followers_url":"https://api.github.com/users/mikejhathaway/followers","following_url":"https://api.github.com/users/mikejhathaway/following{/other_user}","gists_url":"https://api.github.com/users/mikejhathaway/gists{/gist_id}","starred_url":"https://api.github.com/users/mikejhathaway/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikejhathaway/subscriptions","organizations_url":"https://api.github.com/users/mikejhathaway/orgs","repos_url":"https://api.github.com/users/mikejhathaway/repos","events_url":"https://api.github.com/users/mikejhathaway/events{/privacy}","received_events_url":"https://api.github.com/users/mikejhathaway/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2018-04-30T14:12:00Z","updated_at":"2018-05-01T13:24:46Z","closed_at":null,"author_association":"NONE","body":"Hi There,\r\n\r\nAm testing out the CMP client and am getting the following when using 3GPP vendor certificates for enrollment, what key usage is the CMP client looking for from a CA, Certificate Sign, CRL Sign are standard for a CA so am a little confused by the error?\r\n\r\n    C:\\work>openssl cmp -cmd ir -server 10.59.63.170:8040 -path cmpv2/CMPConfig1 -cert cmp_client.cer -key cmp_client.key -certout cmp_client_new.pem -newkey cmp_client_new.key -subject \"/CN=cmp_client\" -extracerts DeviceCA.cer -implicitconfirm -srvcert CMPCA.cer\r\n    CMP INFO: using OpenSSL configuration file 'C:\\tools\\OpenSSL\\SSL/openssl.cnf'\r\n    warning: no [cmp section found in config file 'C:\\tools\\OpenSSL\\SSL/openssl.cnf'; will thus use just \r\n    [default] and unnamed section if present\r\n    CMP INFO: sending ir\r\n    CMP INFO: got response\r\n    CMP ERROR: 350AA0B0:CMP routines:CMP_verify_signature:wrong key \r\n    usage:crypto\\cmp\\cmp_vfy.c:50:\r\n    CMP ERROR: 350A808E:CMP routines:CMP_validate_msg:invalid certificate:crypto\\cmp\\cmp_vfy.c:236:\r\n    signature verification at depth=-1 error=1 (unspecified certificate verification error)\r\n    failure for:\r\n        certificate\r\n            Subject: C=GB, O=ACME, OU=Certification Authorities, CN=CMP Test Certification Authority\r\n            self-signed\r\n            Serial Number: 1502804345 (0x5992f979)\r\n            Validity\r\n                Not Before: Aug 15 13:09:05 2017 GMT\r\n                Not After : Aug 15 13:39:05 2027 GMT\r\n            X509v3 extensions:\r\n                X509v3 Private Key Usage Period:\r\n                    Not Before: Aug 15 13:09:05 2017 GMT, Not After: Aug 15 13:39:05 2027 GMT\r\n                X509v3 Key Usage:\r\n                    Certificate Sign, CRL Sign\r\n                X509v3 Authority Key Identifier:\r\n                    keyid:33:56:09:C5:B8:A9:3B:B5:39:D3:9E:1C:E0:7E:D3:0C:CE:7A:66:26\r\n    \r\n                X509v3 Subject Key Identifier:\r\n                    33:56:09:C5:B8:A9:3B:B5:39:D3:9E:1C:E0:7E:D3:0C:CE:7A:66:26\r\n                X509v3 Basic Constraints:\r\n                    CA:TRUE\r\n    CMP ERROR: 3509B088:CMP routines:CMP_PKIMESSAGE_check_received:error validating \r\n    protection:crypto\\cmp\\cmp_lib.c:1809:\r\n\r\nThanks\r\n\r\nMike"},"comment":{"url":"https://api.github.com/repos/mpeylo/cmpossl/issues/comments/385669846","html_url":"https://github.com/mpeylo/cmpossl/issues/133#issuecomment-385669846","issue_url":"https://api.github.com/repos/mpeylo/cmpossl/issues/133","id":385669846,"user":{"login":"mpeylo","id":9685382,"avatar_url":"https://avatars1.githubusercontent.com/u/9685382?v=4","gravatar_id":"","url":"https://api.github.com/users/mpeylo","html_url":"https://github.com/mpeylo","followers_url":"https://api.github.com/users/mpeylo/followers","following_url":"https://api.github.com/users/mpeylo/following{/other_user}","gists_url":"https://api.github.com/users/mpeylo/gists{/gist_id}","starred_url":"https://api.github.com/users/mpeylo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mpeylo/subscriptions","organizations_url":"https://api.github.com/users/mpeylo/orgs","repos_url":"https://api.github.com/users/mpeylo/repos","events_url":"https://api.github.com/users/mpeylo/events{/privacy}","received_events_url":"https://api.github.com/users/mpeylo/received_events","type":"User","site_admin":false},"created_at":"2018-05-01T13:24:46Z","updated_at":"2018-05-01T13:24:46Z","author_association":"OWNER","body":"A Wireshark trace might help to quickly identify the root cause of the issue - unless the server implementation would have a really deep problem when generating the signature."}}
{"actor":{"display_login":"mpeylo"}}