The Lowly Life of a Tech: x509

Showing posts with label x509. Show all posts

Thursday, October 31, 2013

understanding certificate chaining

Help - WebSphere MQ

http://publib.boulder.ibm.com/infocenter/wmqv6/v6r0/index.jsp?topic=%2Fcom.ibm.mq.csqzas.doc%2Fsy10600_.htm

Illustrates a certification path from the certificate owner to the root CA, where the chain of trust begins

Intel(R) AMT SDK Implementation and Reference Guide

http://software.intel.com/sites/manageability/AMT_Implementation_and_Reference_Guide/default.htm?turl=WordDocuments%2Fcertificatechainsforhostbasedconfiguration.htm

Certificate chains may be included with a public key by simply including the rfc blocks in pem format. Their inclusion order is important, though. Consider using cat so that no extra whitespace gets introduced.

OpenSSL - User - check certificate chain in a pem file

http://openssl.6102.n7.nabble.com/check-certificate-chain-in-a-pem-file-td43871.html

It is highly recommended that you convert to and from .pfx files on your own machine using OpenSSL so you can keep the private key there. Use the following OpenSSL commands to convert SSL certificate to different formats on your own machine:

#Convert PEM to P7B
openssl crl2pkcs7 -nocrl -certfile certificate.cer -out certificate.p7b -certfile CACert.cer

#see html reference for more

check certificate chain in a pem file

https://www.sslshopper.com/ssl-converter.html

Concatenate all the previous certificates and the root certificate to one temporary file (This example is for when you are checking the third certifate from the bottom, having already checked cert1.pem and cert2.pem

Thus for the first round through the commands would be

   Unix:     cat root.pem > root-chain.pem
   Windows:  copy /A root.pem root-chain.pem
   Both:     openssl verify -CAfile root-chain.pem cert1.pem

And the second round would be

   Unix:     cat cert1.pem root.pem > cert1-chain.pem
   Windows:  copy /A cert1.pem+root.pem cert1-chain.pem
   Both:     openssl verify -CAfile cert1-chain.pem cert2.pem

Etc.

"keytool -export/import" - Exporting and Importing Certificates

http://www.herongyang.com/JDK/keytool-export-import-Certificates.html

The "-export" command option exports the self-signed certificate of my public key into a file, my_home.crt.
The "-printcert" command option prints out summary information of a certificate stored in a file in X.509 format. As you can see from the print out, I am the issuer and the owner of this certificate.
The "-import" command option imports the certificate from the certificate file back into the keystore under different alias, my_home_crt.

TechStump.com: How to Rearrange a Certificate Chain using OpenSSL

http://www.techstump.com/2012/10/how-to-rearrange-certificate-chain.html

..you do need to know the correct certificate order. The first two are easy, the key should be first and the Server Certificate should be second. Generally the third certificate will be an intermediate and the last will be a root. If you look at each section, you’ll see a -------Begin Certificate------ and -------End Certificate------ section preceded by a header. In the header you’ll see what certificate is what.

keytool-Key and Certificate Management Tool

http://docs.oracle.com/javase/7/docs/technotes/tools/windows/keytool.html

-importcert {-alias alias} {-file cert_file} [-keypass keypass] {-noprompt} {-trustcacerts} {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg</pre>
 {-v} {-protected} {-Jjavaoption}

Reads the certificate or certificate chain (where the latter is supplied in a PKCS#7 formatted reply or a sequence of X.509 certificates) from the file cert_file, and stores it in the keystore entry identified by alias. If no file is given, the certificate or certificate chain is read from stdin.

.. keytool can import X.509 v1, v2, and v3 certificates, and PKCS#7 formatted certificate chains consisting of certificates of that type. The data to be imported must be provided either in binary encoding format, or in printable encoding format (also known as Base64 encoding) as defined by the Internet RFC 1421 standard. In the latter case, the encoding must be bounded at the beginning by a string that starts with "-----BEGIN", and bounded at the end by a string that starts with "-----END".

Option defaults for keytool

-storetype the value of the "keystore.type" property in the security properties file,
           which is returned by the static getDefaultType method in
           java.security.KeyStore

Help - IBM SDK and Runtime Environment Java Technology Edition Version 6

http://publib.boulder.ibm.com/infocenter/javasdk/v6r0/index.jsp?topic=%2Fcom.ibm.java.security.component.doc%2Fsecurity-component%2FkeytoolDocs%2Fsupportedkeystoretypes.html

Supported Key Store Types

JKS
JCEKS . This keystore implementation employs a much stronger protection of private keys (using password-based encryption with Triple DES) than JKS. You can upgrade your keystore of type "JKS" to type "JCEKS" by changing the password of a private-key entry in your keystore.
PKCS12. There is a difference between PKCS12 type keystore created on the keytool provided in the IBM JVM and the keytool provided in an Oracle JVM. The keytool in an IBM JVM uses a PKCS12 keystore to store both key entries and certificate entries.The keytool in an Oracle JVM uses a PKCS12 keystore to store key entries. The keytool program in IBM's JVM can read the keystore created by the keytool program provided by an Oracle JVM, but not the other way around.
PKCS12S2. This is a second version of PKCS12 type keystore. It can be read by the keytool program in an Oracle JVM.
JCERACFKS. This is a RACF® keyring keystore. This type is available only on z/OS® systems with RACF installed.

OpenSSL: Documents, pkcs7(1)

http://www.openssl.org/docs/apps/pkcs7.html

A different way to package a keystore. Like JKS, only different format.

Creating a PKCS7 (P7B) Using OpenSSL

https://langui.sh/2009/03/20/creating-a-pkcs7-p7b-using-openssl/

This example assumes that you have 2 different certificate files, each in PEM (Base64) format. You can add as many -certfile elements as you want to package in the file. Additionally, concatenated certificate chains are supported.

openssl crl2pkcs7 -nocrl -certfile cert1.cer -certfile cert2.cer -out outfile.p7b

OpenSSL: Documents, verify(1)

http://www.openssl.org/docs/apps/verify.html

The verify command verifies certificate chains.

Tuesday, October 1, 2013

weblog; missing CA Root

X.509 Certificates

The Most Common Java Keytool Keystore Commands

http://www.sslshopper.com/article-most-common-java-keytool-keystore-commands.html

Display the contents of a stand-alone certificate. Doesn't show as much details as the openssl command.

Keytool

keytool -printcert -v -file mydomain.crt

OpenSSL

openssl x509 -noout -text -in mydomain.crt

Download Primary PCA Root Certificates | Symantec

http://www.symantec.com/page.jsp?id=roots

Needed to complete CA Root chain for Oracle/PeopleSoft. This seems to do the trick.

wget http://www.verisign.com/repository/roots/root-certificates/PCA-3G3.pem

No trusted certificate found : when opeing a ssl connection from behind the proxy. (Open Source Projects forum at JavaRanch)

http://www.coderanch.com/t/62494/open-source/trusted-certificate-opeing-ssl-connection

http://www.coderanch.com/t/62494/open-source/trusted-certificate-opeing-ssl-connection
http://stackoverflow.com/questions/10749803/validatorexception-no-trusted-certificate-found-in-java

Two-way ssl handshake

handshake initiated by client; client sends it's identification
server receives, authenticates client and accepts
server sends it's identification
client receives, but fails to authenticate

In our case, it seems the problem is an incomplete CA Root chain.

Saturday, September 28, 2013

weblog; Apache CXF; getting message-level encryption to work

Bash

Bash Arrays | Linux Journal

http://www.linuxjournal.com/content/bash-arrays

Provide a list in open/close parentheses, unadorned.

array=(one two three four [5]=five)

echo "Array size: ${#array[*]}"

echo "Array items:"
for item in ${array[*]}
do
    printf "   %s\n" $item
done

Bash For Loop Examples

http://www.cyberciti.biz/faq/bash-for-loop/

The array here doesn't use parentheses.

for VARIABLE in 1 2 3 4 5 .. N
do
 command1
 command2
 commandN
done

bash - escaping newlines in sed replacement string - Stack Overflow

http://stackoverflow.com/questions/8991275/escaping-newlines-in-sed-replacement-string

Newlines will be recognized in the replace clause (the second half), but not in the match clause. Instead, you will need to use the N and D flags.

echo 'abc' | sed 's/b/\ 
> /'
a
c

Gather dependencies from pom files

http://www.grymoire.com/Unix/Sed.html#uh-51

Navigate to the root directory of Maven project with sub-modules, copy and paste the following code. The code depends on the correct order of a dependency declaration: groupId, articleId, version. Otherwise, all bets are off. This is intended to be quick and dirty; a SAX parser would be more robust.

The following temp files are used for each pom.xml in turn.

work.txt: contains ''
work2.txt: strips off '', leaving groupId:articleId:version

results.txt: The final file, providing a compilation of dependencies for all pom.xml files.

for file in $(find . -name "pom.xml")
do

cfile=$(printf '%q' $file)

sed '
# look for a <groupId>...</groupId>
/[^<]*<groupId>\([^<]*\)<\/groupId>.*$/ {
# Found one - now read in the next line
 N
# delete the <groupId>...</groupId> and replace with <maven-dependency>
 s/[^<]*<groupId>\([^<]*\)<\/groupId>[\n\r]*[^<]*/<maven-dependency>\1/
}

/<artifactId>\([^<]*\)<\/artifactId>.*$/ {
 N
 s/<artifactId>\([^<]*\)<\/artifactId>[\n\r]*[^<]*/:\1/
}

s/<version>\([^<]*\)<\/version>.*/:\1<\/maven-dependency>/

' $file > work.txt

echo -e "\n${cfile}\n===========================================" > work2.txt

cat work.txt | grep "<maven-dependency>[^<]*<\/maven-dependency>" | sed "s/<maven-dependency>\([^<]*\)<\/maven-dependency>/\1/" >> work2.txt; cat work2.txt

cat work2.txt >> results.txt

done

Along the same lines, there is also a little Ruby script for extracting out the articleId from the groupId:articleId:version:

#[Extract dependency name (Ruby)]

#E.g., 
dependencies = %w[
edu.ucmerced.ucpath.idm:ucm-ucpath-idm:0.0.2-SNAPSHOT
it.svario.xpathapi:xpathapi-jaxp:RELEASE
org.eclipse.m2e:lifecycle-mapping:1.0.0
org.apache.maven.plugins:maven-install-plugin:2.4
com.google.code.maven-replacer-plugin:replacer:1.5.2
org.codehaus.mojo:properties-maven-plugin:1.0-alpha-2
org.apache.maven.plugins:maven-install-plugin:2.4
com.google.code.maven-replacer-plugin:replacer:1.5.2
]

puts dependencies.map{|x| first = x.index(/:/); x.slice(first+1, x.index(/:/, first+1) - first-1)}

How to reference a variable within sed? - The UNIX and Linux Forums

http://www.unix.com/shell-programming-scripting/39175-how-reference-variable-within-sed.html

tmp="abcdefg"
sed "s/${tmp}/good"

Replace the single quotes with double quotes. Single quotes prevent variable expansion.
http://www.unix.com/shell-programming-scripting/39175-how-reference-variable-within-sed.html

escape string in bash script so it can be used in command line

http://www.linuxquestions.org/questions/linux-software-2/escape-string-in-bash-script-so-it-can-be-used-in-command-line-360664/

Use double quotes.

You don't need to escape a string if you quote it - say you want to pass all the arguments to ls, instead of

ls $*

write

ls "$*"

Java; web services

Web Service Definition Language (WSDL)

http://www.w3.org/TR/wsdl#_soap:address

What purpose does soap:address serve? It appears to be the actual endpoint.

<definitions .... >
    <port .... >
        <binding .... >
           <soap:address location="uri"/> 
        </binding>
    </port>
</definitions>

? Apache CXF -- WS-SecurityPolicy http://cxf.apache.org/docs/ws-securitypolicy.html

Configuration for message-level encryption can be easily accomplished. The following server and client configurations should be loaded either in the Server/Client Java class or in the pom.xml configuration

Java Class

  SpringBusFactory bf = new SpringBusFactory();
  URL busFile = new ClassPathResource("wssec-server.xml").getURL();
  Bus bus = bf.createBus(busFile.toString());
  BusFactory.setDefaultBus(bus);

pom.xml

<plugin>
    <groupId>org.codehaus.mojo</groupId>
    <artifactId>exec-maven-plugin</artifactId>
    <executions>
        <execution>
            <phase>test</phase>
            <goals>
                <goal>java</goal>
            </goals>
            <configuration>
                <mainClass>edu.ucmerced.ucpath.idm.Runner</mainClass>
                <arguments>
                    <argument>../ws-ora-idm-wsdl/src/main/resources/wsdl/IDMServices/IDMServices.wsdl</argument>
                </arguments>
                <systemProperties>
                  <systemProperty>
                    <key>cxf.config.file</key>
                    <value>cxf-client.xml</value>     
                  </systemProperty>
                </systemProperties>
            </configuration>
        </execution>
    </executions>
</plugin>

Server

    <jaxws:endpoint id="server"
      implementor="demo.wssec.server.GreeterImpl"
      endpointName="s:SoapPort"
      serviceName="s:SOAPService"
      address="http://localhost:9001/SoapContext/SoapPort"
      wsdlLocation="wsdl/hello_world.wsdl"
      xmlns:s="http://apache.org/hello_world_soap_http">
        
      <jaxws:properties>
         <entry key="ws-security.signature.properties" value="serviceKeystore.properties"/>
         <entry key="ws-security.signature.username" value="myservicekey"/>

         <entry key="ws-security.callback-handler" 
                value="demo.wssec.server.ServerCallbackHandler"/>

         <entry key="ws-security.encryption.properties" value="serviceKeystore.properties"/>
         <entry key="ws-security.encryption.username" value="myclientkey"/>
      </jaxws:properties> 
    </jaxws:endpoint>

Client

    <jaxws:client name="{http://apache.org/hello_world_soap_http}SoapPort" createdFromAPI="true">
       <jaxws:properties>
           <entry key="ws-security.signature.properties" value="clientKeystore.properties"/>
           <entry key="ws-security.signature.username" value="myclientkey"/>
           <entry key="ws-security.callback-handler" 
                  value="demo.wssec.client.ClientCallbackHandler"/>
           <entry key="ws-security.encryption.properties" value="clientKeystore.properties"/> 
           <entry key="ws-security.encryption.username" value="myservicekey"/>
       </jaxws:properties>
   </jaxws:client>

Propery files should include location of certificates and keystore password. The private key password cannot be provided here, but should use the callback to provide the correct private key.

Properties

org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin
org.apache.ws.security.crypto.merlin.keystore.type=jks
org.apache.ws.security.crypto.merlin.keystore.password=sspass
org.apache.ws.security.crypto.merlin.keystore.alias=myservicekey
org.apache.ws.security.crypto.merlin.keystore.file=keys/servicestore.jks

Java callback-handler

public void handle(Callback[] callbacks) throws IOException,
        UnsupportedCallbackException {
    for (int i = 0; i < callbacks.length; i++) {
        if (callbacks[i] instanceof WSPasswordCallback) {
            WSPasswordCallback pc = (WSPasswordCallback) callbacks[i];
            if ("myservicekey".equals(pc.getIdentifier())) {
                pc.setPassword("skpass");
                break;
            }
        }
    }
}

See https://github.com/dcvezzani/mustached-batman for a complete example.

Maven Repository: org.apache.ws.security » wss4j

» 1.5.6 http://mvnrepository.com/artifact/org.apache.ws.security/wss4j/1.5.6

Pom.xml dependency entry.

<dependency>
 <groupId>org.apache.ws.security</groupId>
 <artifactId>wss4j</artifactId>
 <version>1.5.6</version>
</dependency>

WS-SecurityPolicy 1.2

http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/ws-securitypolicy-1.2-spec-os.html

Documentation of the nodes in the WS-SecuirtyPolicy namespace.

XML Namespace Document for WS-Security-Policy 1.3

http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200802

Documentation of the nodes in the WS-SecuirtyPolicy namespace.

Re: Eclipse, CXF and WS-SecurityPolicy

http://mail-archives.apache.org/mod_mbox/cxf-users/201307.mbox/%3CF172D30F-6747-44B2-A4CE-7EFBD7710DEA@indivica.com%3E

https://www.google.com/search?q=cxf+%22No+assertion+builder%22&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a

An error like what follows indicates that possibly the wrong namespace is being specified or the namespace is missing altogether.

> Jul 27, 2013 12:41:56 AM org.apache.cxf.ws.policy.AssertionBuilderRegistryImpl handleNoRegisteredBuilder
> WARNING: No assertion builder for type {http://schemas.xmlsoap.org/ws/2005/07/securitypolicy}RequiredParts registered.

Maven Repository: org.apache.cxf » cxf-rt-ws-security

» 2.4.1 http://mvnrepository.com/artifact/org.apache.cxf/cxf-rt-ws-security/2.4.1

Entry description

<dependency>
 <groupId>org.apache.cxf</groupId>
 <artifactId>cxf-rt-ws-security</artifactId>
 <version>2.4.1</version>
</dependency>

Java web services: WS-Security with CXF

http://www.ibm.com/developerworks/library/j-jws13/

Walk-through for creating a web service, using WS-Security with the Apache CXF web services stack

X.509 Certificates

X.509 - Wikipedia, the free encyclopedia

http://en.wikipedia.org/wiki/X.509

Was researching what exactly the significance is of signed certificates.

As far as I can tell, most of the time it's only purpose is to validate a trusted public key.

The Most Common Java Keytool Keystore Commands

http://www.sslshopper.com/article-most-common-java-keytool-keystore-commands.html

https://www.google.com/search?q=keytool+view+public+cert&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a

A great resource common keytool commands.

Monday, July 22, 2013

Work notes; ssl and certificates

SSL; Cipher suites

What are cipher suites?

http://en.wikipedia.org/wiki/Cipher_suite

Configuring Apache to accept a particular list of cipher suites

https://httpd.apache.org/docs/2.0/ssl/ssl_howto.html

Testing ssl connections using OpenSSL's s_client and s_server

http://wiki.wireshark.org/SSL

Bash script to test OpenSSL's supported cipher suites against a given web server

https://www.ssllabs.com/ssltest/index.html

OpenSSL's documentation for ciphers

http://www.openssl.org/docs/apps/ciphers.html#NAME

How to Disable SSL weak Ciphers in Tomcat Server

http://www.fromdev.com/2009/02/tomcat-best-practices-securing-ssl-by.html

How to control the SSL ciphers available to Tomcat

http://stackoverflow.com/questions/7417809/how-to-control-the-ssl-ciphers-available-to-tomcat

Java™ Cryptography Architecture Standard Algorithm Name Documentation; JSSE Cipher Suite Names

http://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#jssenames

SSLHandshakeException: Received fatal alert: handshake_failure when setting ciphers on tomcat 7 server

http://stackoverflow.com/questions/15544116/sslhandshakeexception-received-fatal-alert-handshake-failure-when-setting-ciph?rq=1

-keyalg is only one part of the solution; the other peer involved in the ssl conversation must support a compatible hash algorith for OID in addition to supporting a common cipher suite