eab_profile_subject_check

[DMBrosig]

Hi,

in V0.36 with EAB against MS-AD config like example

"linux":
{
"hmac": "xxxx",
"cahandler":
{
"template_name": "WebserverACME",
"subject":
{
"commonName": "*",
"organizationName": "blabla",
"organizationalUnitName": "blabla",
"countryName": "DE",
"stateOrProvinceName": "Mecklenburg-Vorpommern",
"localityName": "blabla"
}
}
}
}

bring error

Helper.eab_profile_subject_check() failed for: ['commonName', 'organizationName', 'organizationalUnitName', 'countryName', 'stateOrProvinceName', 'localityName']

../tools/eab_chk.py -c acme_srv.cfg show everything is fine. The template_name was taken from config file, subject data not.

What's wrong?

Best regards
Dirk

[grindsa]

Hi Dirk,

can you please enable debug mode (debug = True in acme_srv.cfg) replace the issue and share the debug log?

If you prefer to share via Email please send it [email protected]

Thx G.

[DMBrosig]

Hi G.

debug was on, log to syslog...

Feb 6 09:37:10 HOTacme bash[23702]: EABhandler.eab_kid_get() ended with: linux
Feb 6 09:37:10 HOTacme bash[23702]: EABhandler._eab_profile_get() ended with: True
Feb 6 09:37:10 HOTacme bash[23702]: Helper.eab_profile_string_check(): string: key: template_name, value: WebserverACME
Feb 6 09:37:10 HOTacme bash[23702]: Helper.eab_profile_string_check(): ignore string attribute: key: template_name value: WebserverACME
Feb 6 09:37:10 HOTacme bash[23702]: Helper.eab_profile_string_check() ended
Feb 6 09:37:10 HOTacme bash[23702]: Helper.eab_profile_subject_check()
Feb 6 09:37:10 HOTacme bash[23702]: Helper.csr_subject_get()
Feb 6 09:37:10 HOTacme bash[23702]: Helper.cert_load()
Feb 6 09:37:10 HOTacme bash[23702]: Helper.b64_url_recode()
Feb 6 09:37:10 HOTacme bash[23702]: Helper.build_pem_file()
Feb 6 09:37:10 HOTacme bash[23702]: Helper.csr_subject_get() ended
Feb 6 09:37:10 HOTacme bash[23702]: Helper.eab_profile_subject_check() failed for: ['commonName', 'organizationName', 'organizationalUnitName', 'countryName', 'stateOrProvinceName', 'localityName']
Feb 6 09:37:10 HOTacme bash[23702]: Helper.eab_profile_subject_check() ended with: Profile subject check failed
Feb 6 09:37:10 HOTacme bash[23702]: Helper.header_info_lookup(template)
Feb 6 09:37:10 HOTacme bash[23702]: Helper.header_info_get()

Is this enough?

BR Dirk

[grindsa]

Thx .. this is helpful.

Another question: what is the subject of the CSR? Can you send me the output of openssl req -text -noout -in <csr.pem>?

/G.

[DMBrosig]

It is complete empty without alternative name.

Certificate Request:
Data:
Version: 1 (0x0)
Subject:
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (4096 bit)
Modulus:
00:ca:55:19:ea:12:56:84:13:ae:30:27:61:0e:0c:...
Exponent: 65537 (0x10001)
Attributes:
Requested Extensions:
X509v3 Subject Alternative Name:
DNS:name.domain.de
Signature Algorithm: sha256WithRSAEncryption
Signature Value:
26:fd:7e:0f:f2:2c:d0:d4:6c:97:25:25:70:45:6b:6a:31:c4:...
/Dirk

[grindsa]

Thank you once again. The reason for the failed check is that your EAB profile mandates the presence of certain subject attributes (such as O, OU, L, C), which are missing in your CSR.

Perhaps the description of the subject-profiling feature needs improvement. The main aim of this feature is not to set subject attributes (as modifying a CSR would break the signature, which is impossible for transit devices like acme2certifier) but rather to check the attributes from a submitted CSR against pre-defined values from your profile file.

It seems you would like to enforce certain attributes to be set in the certificate. If this is the case, I suggest doing this via a template on the CA server itself.

Or did I misunderstand your intention?

Best regards, G.

[DMBrosig]

I assumed that I would be able to set the values automatically. I misunderstood that. If I can do this in acme2certifier, I don't have to do it in the MS CA, because then I would need countless templates. The changes in acme2certifier would be much easier to realise. Is this possible to set these CSR values? Best regards Dirk Von: grindsa ***@***.***> Gesendet: Donnerstag, 6. Februar 2025 20:14 An: grindsa/acme2certifier ***@***.***> Cc: Dirk-Michael Brosig ***@***.***>; Author ***@***.***> Betreff: Re: [grindsa/acme2certifier] eab_profile_subject_check (Issue #202) Thank you once again. The reason for the failed check is that your EAB profile mandates the presence of certain subject attributes (such as O, OU, L, C), which are missing in your CSR. Perhaps the description of the subject-profiling <https://github.com/grindsa/acme2certifier/blob/master/docs/eab_profiling.md#subject-profiling> feature needs improvement. The main aim of this feature is not to set subject attributes (as modifying a CSR would break the signature, which is impossible for transit devices like acme2certifier) but rather to check the attributes from a submitted CSR against pre-defined values from your profile file. It seems you would like to enforce certain attributes to be set in the certificate. If this is the case, I suggest doing this via a template on the CA server itself. Or did I misunderstand your intention? Best regards, G. — Reply to this email directly, view it on GitHub <#202 (comment)> , or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABR5SYQXQO3V5FWZOZKL35T2OOX7VAVCNFSM6AAAAABWS6DYFCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMNBQG43TCOBVGA> . You are receiving this because you authored the thread. <https://github.com/notifications/beacon/ABR5SYQRDOWYD7S3PXEBMD32OOX7VA5CNFSM6AAAAABWS6DYFCWGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTU5M35QU.gif> Message ID: ***@***.*** ***@***.***> >