Re: [PATCH ima-evm-utils v8 3/3] Read keyid from the cert appended to the key file

[Vitaly Chikunov <vt@altlinux.org>]

Mimi,

On Wed, Jul 14, 2021 at 12:16:57PM -0400, Mimi Zohar wrote:
> On Mon, 2021-07-12 at 08:44 +0300, Vitaly Chikunov wrote:
> > 
> > @@ -43,26 +43,43 @@ cat > test-ca.conf <<- EOF
> >  	basicConstraints=CA:TRUE
> >  	subjectKeyIdentifier=hash
> >  	authorityKeyIdentifier=keyid:always,issuer
> > +
> > +	[ skid ]
> > +	basicConstraints=CA:TRUE
> > +	subjectKeyIdentifier=12345678
> > +	authorityKeyIdentifier=keyid:always,issuer
> >  EOF
> >  fi
> 
> On my system:
> $ openssl version
> OpenSSL 1.1.1g FIPS  21 Apr 2020
> 
> Not sure this has anything to do with the reason that "skid" is not
> supported.   The resulting files are empty.
> 
> ls -lat *skid*
> -rw-rw-r--. 1 mimi mimi 0 Jul 14 12:02 test-rsa1024_skid.key
> -rw-rw-r--. 1 mimi mimi 0 Jul 14 12:02 test-rsa1024_skid.pub
> 
> - openssl pkey -in test-rsa1024.key -out test-rsa1024.pub -pubout
> - openssl req -verbose -new -nodes -utf8 -sha1 -days 10000 -batch -x509
> -extensions skid -config test-ca.conf -newkey rsa:1024 -out test-
> rsa1024_skid.cer -outform DER -keyout test-rsa1024_skid.key
> Using configuration from test-ca.conf
> Error Loading extension section skid   <===

How `test-ca.conf' looked like? Maybe it's not updated?
Try to run ./gen-keys.sh clean (which is called from make distclean).

Thanks,

> 
> 
> Then the rest of the tests fail.  Probably should check not only if the
> file exists, but the size of the file as well.
> 
> - openssl pkey -in test-rsa1024_skid.key -out test-rsa1024_skid.pub
> -pubout
> Can't open test-rsa1024_skid.key for reading, No such file or directory
> 140493815547712:error:02001002:system library:fopen:No such file or
> directory:crypto/bio/bss_file.c:69:fopen('test-rsa1024_skid.key','r')
> 140493815547712:error:2006D080:BIO routines:BIO_new_file:no such
> file:crypto/bio/bss_file.c:76:
> unable to load key
> 
> 
> - openssl x509 -inform DER -in test-rsa1024_skid.cer
> Can't open test-rsa1024_skid.cer for reading, No such file or directory
> 139636313208640:error:02001002:system library:fopen:No such file or
> directory:crypto/bio/bss_file.c:69:fopen('test-rsa1024_skid.cer','rb')
> 139636313208640:error:2006D080:BIO routines:BIO_new_file:no such
> file:crypto/bio/bss_file.c:76:
> unable to load certificate
> 
> Mimi