From 670244adbca3ca5aa5e199b720061b9110c28abf Mon Sep 17 00:00:00 2001
From: Fraser Tweedale <ftweedal@redhat.com>
Date: Wed, 13 Jan 2016 17:41:05 +1100
Subject: [PATCH] Use correct textual encoding for PKCS #7 objects
PKCS #7 objects are being output with the "CERTIFICATE CHAIN" label
which is invalid (RFC 7468) and unrecognised by many programs
(including OpenSSL). Use the correct "PKCS7" label instead.
Also do a drive-by refactor of the normalizeCertAndReq to remove
some redundant code.
Fixes: https://fedorahosted.org/pki/ticket/1699
---
.../webapps/ca/agent/ca/displayBySerial.template | 4 +--
.../webapps/ca/agent/ca/displayBySerial2.template | 4 +--
.../ca/agent/ca/displayCertFromRequest.template | 4 +--
.../webapps/ca/ee/ca/displayBySerial.template | 4 +--
.../shared/webapps/ca/ee/ca/displayCaCert.template | 6 ++--
.../com/netscape/cmsutil/crypto/CryptoUtil.java | 35 ++--------------------
6 files changed, 13 insertions(+), 44 deletions(-)
diff --git a/base/ca/shared/webapps/ca/agent/ca/displayBySerial.template b/base/ca/shared/webapps/ca/agent/ca/displayBySerial.template
index 2bb2bfab7c2e208555b69188f6f33dd536732e3f..f95434a1b61fcc2eba00537ef050d849160e65aa 100644
--- a/base/ca/shared/webapps/ca/agent/ca/displayBySerial.template
+++ b/base/ca/shared/webapps/ca/agent/ca/displayBySerial.template
@@ -191,11 +191,11 @@ document.write(result.header.certChainBase64);
Base 64 encoded certificate with CA certificate chain in pkcs7 format
</font>
<p><pre>
------BEGIN CERTIFICATE CHAIN-----
<SCRIPT type="text/javascript">
+document.writeln('-----BEGIN PKCS7-----');
document.write(result.header.pkcs7ChainBase64);
+document.writeln('-----END PKCS7-----');
</SCRIPT>
------END CERTIFICATE CHAIN-----
</pre>
<br><p>
diff --git a/base/ca/shared/webapps/ca/agent/ca/displayBySerial2.template b/base/ca/shared/webapps/ca/agent/ca/displayBySerial2.template
index 4a193e3243e79074feabd21e0094f4b5cea635b9..f0604ef7fc3a7a9ec4c1dd016f0652c507e204dd 100644
--- a/base/ca/shared/webapps/ca/agent/ca/displayBySerial2.template
+++ b/base/ca/shared/webapps/ca/agent/ca/displayBySerial2.template
@@ -97,11 +97,11 @@ The following format can be used to install this certificate into a server.
Base 64 encoded certificate
</font>
<p><pre>
------BEGIN CERTIFICATE CHAIN-----
<SCRIPT type="text/javascript">
+document.writeln('-----BEGIN PKCS7-----');
document.write(result.header.certChainBase64);
+document.writeln('-----END PKCS7-----');
</SCRIPT>
------END CERTIFICATE CHAIN-----
</pre>
<br><p>
diff --git a/base/ca/shared/webapps/ca/agent/ca/displayCertFromRequest.template b/base/ca/shared/webapps/ca/agent/ca/displayCertFromRequest.template
index f1148570c5e1cd3c251ee64008228da2e710b421..402154037790343061dc4a711de0d0fba738dbf2 100644
--- a/base/ca/shared/webapps/ca/agent/ca/displayCertFromRequest.template
+++ b/base/ca/shared/webapps/ca/agent/ca/displayCertFromRequest.template
@@ -102,9 +102,9 @@ function displayCert(cert)
'Base 64 encoded certificate with CA certificate chain in pkcs7 format'+
'</font>'+
'<p><pre>'+
- '-----BEGIN CERTIFICATE CHAIN-----');
+ '-----BEGIN PKCS7-----');
document.writeln(cert.pkcs7ChainBase64);
- document.writeln('-----END CERTIFICATE CHAIN-----'+
+ document.writeln('-----END PKCS7-----'+
'</pre>');
}
diff --git a/base/ca/shared/webapps/ca/ee/ca/displayBySerial.template b/base/ca/shared/webapps/ca/ee/ca/displayBySerial.template
index e9b4d72bfb2b23a67c15282ae521b513d7a5dbfd..d482644b768750b704461785fe39eb744db7cbe9 100644
--- a/base/ca/shared/webapps/ca/ee/ca/displayBySerial.template
+++ b/base/ca/shared/webapps/ca/ee/ca/displayBySerial.template
@@ -116,11 +116,11 @@ document.write(result.header.certChainBase64);
Base 64 encoded certificate with CA certificate chain in pkcs7 format
</font>
<p><pre>
------BEGIN CERTIFICATE-----
<SCRIPT LANGUAUGE="JavaScript">
+document.writeln('-----BEGIN PKCS7-----');
document.write(result.header.pkcs7ChainBase64);
+document.writeln('-----END PKCS7-----');
</SCRIPT>
------END CERTIFICATE-----
</pre>
<br><p>
diff --git a/base/ca/shared/webapps/ca/ee/ca/displayCaCert.template b/base/ca/shared/webapps/ca/ee/ca/displayCaCert.template
index 4e93919f53d553872ff9ee98356d81edda9a7640..4da0d74c8302329addf1ec1dd042f7ffe7ea18ae 100644
--- a/base/ca/shared/webapps/ca/ee/ca/displayCaCert.template
+++ b/base/ca/shared/webapps/ca/ee/ca/displayCaCert.template
@@ -43,9 +43,9 @@ if (result.header.displayFormat == "chain") {
document.writeln('<center><b>' + result.header.subjectdn);
document.writeln('</b></center><p></font><br>');
document.writeln('<pre>');
- document.writeln('-----BEGIN CERTIFICATE-----');
- document.writeln(result.header.chainBase64);
- document.writeln('-----END CERTIFICATE-----');
+ document.writeln('-----BEGIN PKCS7-----');
+ document.write(result.header.chainBase64);
+ document.writeln('-----END PKCS7-----');
document.writeln('</pre>');
} else if (result.header.displayFormat == "individual") {
if (result.recordSet.length == 0) {
diff --git a/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java b/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java
index 3b1041a74bb4b663dd9c5f4c9fa983da133f04a3..59883831afa5c9016594c54bbb25bf5f503f00b7 100644
--- a/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java
+++ b/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java
@@ -822,46 +822,15 @@ public class CryptoUtil {
if (s == null) {
return s;
}
- s = s.replaceAll("-----BEGIN CERTIFICATE REQUEST-----", "");
- s = s.replaceAll("-----BEGIN NEW CERTIFICATE REQUEST-----", "");
- s = s.replaceAll("-----END CERTIFICATE REQUEST-----", "");
- s = s.replaceAll("-----END NEW CERTIFICATE REQUEST-----", "");
- s = s.replaceAll("-----BEGIN CERTIFICATE-----", "");
- s = s.replaceAll("-----END CERTIFICATE-----", "");
- s = s.replaceAll("-----BEGIN CERTIFICATE CHAIN-----", "");
- s = s.replaceAll("-----END CERTIFICATE CHAIN-----", "");
+ // grammar defined at https://tools.ietf.org/html/rfc7468#section-3
+ s = s.replaceAll("-----(BEGIN|END) [\\p{Print}&&[^- ]]([- ]?[\\p{Print}&&[^- ]])*-----", "");
StringBuffer sb = new StringBuffer();
StringTokenizer st = new StringTokenizer(s, "\r\n ");
while (st.hasMoreTokens()) {
String nextLine = st.nextToken();
-
nextLine = nextLine.trim();
- if (nextLine.equals("-----BEGIN CERTIFICATE REQUEST-----")) {
- continue;
- }
- if (nextLine.equals("-----BEGIN NEW CERTIFICATE REQUEST-----")) {
- continue;
- }
- if (nextLine.equals("-----END CERTIFICATE REQUEST-----")) {
- continue;
- }
- if (nextLine.equals("-----END NEW CERTIFICATE REQUEST-----")) {
- continue;
- }
- if (nextLine.equals("-----BEGIN CERTIFICATE-----")) {
- continue;
- }
- if (nextLine.equals("-----END CERTIFICATE-----")) {
- continue;
- }
- if (nextLine.equals("-----BEGIN CERTIFICATE CHAIN-----")) {
- continue;
- }
- if (nextLine.equals("-----END CERTIFICATE CHAIN-----")) {
- continue;
- }
sb.append(nextLine);
}
return sb.toString();
--
2.4.3