"Error: error:0909006C:PEM routines:get_name:no start line" when calling tls.createSecureContext with a self-signed certificate - node.js

I've created a self-signed certificate for testing purposes with the pass phrase "foobar" using this command:
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 365
I'm then trying to call tls.createSecureContext with that certificate-key pair like so:
var tls = require('tls');
var fs = require('fs');
const [key, cert] = [
fs.readFileSync("key.pem"),
fs.readFileSync("cert.pem"),
];
tls.createSecureContext({key, cert})
However, this leads to the following error:
> node main.js
node:internal/tls/secure-context:69
context.setCert(cert);
^
Error: error:0909006C:PEM routines:get_name:no start line
at node:internal/tls/secure-context:69:13
at Array.forEach (<anonymous>)
at setCerts (node:internal/tls/secure-context:67:3)
at configSecureContext (node:internal/tls/secure-context:156:5)
at Object.createSecureContext (node:_tls_common:116:3)
at Object.<anonymous> (/Users/kurtpeek/go/src/github.pie.apple.com/kurt-peek/scratch/node/main.js:9:5)
at Module._compile (node:internal/modules/cjs/loader:1246:14)
at Module._extensions..js (node:internal/modules/cjs/loader:1300:10)
at Module.load (node:internal/modules/cjs/loader:1103:32)
at Module._load (node:internal/modules/cjs/loader:942:12) {
library: 'PEM routines',
function: 'get_name',
reason: 'no start line',
code: 'ERR_OSSL_PEM_NO_START_LINE'
}
Node.js v19.5.0
This question appears to be the same as Error: error:0909006C:PEM routines:get_name:no start line - node but I wasn't able to find an answer there. (For example, I tried applying unix2dos to cert.pem and key.pem, but to no avail). Any ideas on how to fix this?

Related

Extract private key from PFX file which doesn't contain certificate using Bouncy Castle

Here is my scenario:
Using the following openssl command to generate the pfx file which doesn't contains cert:
openssl.exe genrsa -aes256 -out E:\Temp\test.pem -passout pass:123456 2048 2
openssl.exe pkcs12 -keypbe PBE-SHA1-3DES -aes256 -export -nocerts -inkey E:\Temp\test.pem -out E:\Temp\test.pfx -passin pass:123456 -passout pass:123456
I am trying to parse the key out of the pfx file using bouncy castle. here is the simple code:
string psw = "123456";
string pfxPath = #"E:\Temp\test.pfx";
using (Stream stream = File.Open(pfxPath, FileMode.Open))
{
Pkcs12Store pkcs = new Pkcs12StoreBuilder().Build();
pkcs.Load(stream, psw.ToArray());
}
However, pkcs is empty. I think it is because the PFX file doesn't have a certificate. So my question is: is there a way that bouncy castle can handle this situation?

NodeJs - Error: error:0906D06C:PEM routines:PEM_read_bio:no start line

I am trying to use godaddy ssl certificates on ec2. But getting this error.
Error: error:0906D06C:PEM routines:PEM_read_bio:no start line
Flow I used.
openssl req -new -newkey rsa:2048 -nodes -keyout foo.com.key -out
foo.com.csr
used foo.com.csr to generate the godaddy and got 3 files.
3b8bc5516b18ff0.crt , 3b8bc5516b18ff0.pem and gd_bundle-g2-g1.crt
var privateKey = fs.readFileSync('3b8bc5516b18ff0.pem');
var certificate = fs.readFileSync('3b8bc5516b18ff0.crt');
/**
* And converted gd_bundele to gd0, gd1, gd2
*/
var credentials = {
key: privateKey,
cert: certificate,
ca: [
fs.readFileSync('gd0.crt'),
fs.readFileSync('gd1.crt'),
fs.readFileSync('gd2.crt')
]
};
//http.createServer(app);
var httpsServer = https.createServer(credentials, app);
I got the solution .
openssl req -new -newkey rsa:2048 -nodes -keyout foo.com.pem -out foo.com.csr
foo.com.pem should be passed as privatekey.
NOTE : It is important save the key with which the csr was created and sent to the godaddy (I called foo.com.pem).

Pass certificates into requests lib

I have https server written on Python which uses self singed certs:
server_cert = 'certs/server/server.crt'
server_key = 'certs/server/server.key'
client_certs = 'certs/client/client.crt'
context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
context.verify_mode = ssl.CERT_REQUIRED
context.load_cert_chain(certfile=server_cert, keyfile=server_key)
context.load_verify_locations(cafile=client_certs)
Steps to certs generate:
openssl req -new -newkey rsa:2048 -days 365 -nodes -x509 -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=localhost/UID=testnotifier" -keyout ${certs}/server/server.key -out ${certs}/server/server.crt
openssl req -new -newkey rsa:2048 -days 365 -nodes -x509 -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=localhost/UID=testnotifier" -keyout ${certs}/client/client.key -out ${certs}/client/client.crt
Also I have https client:
#!/usr/bin/python3
import socket
import ssl
host_addr = '127.0.0.1'
host_port = 8082
server_sni_hostname = 'localhost'
server_cert = 'certs/server/server.crt'
client_cert = 'certs/client/client.crt'
client_key = 'certs/client/client.key'
context = ssl.create_default_context(ssl.Purpose.SERVER_AUTH, cafile=server_cert)
context.load_cert_chain(certfile=client_cert, keyfile=client_key)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
conn = context.wrap_socket(s, server_side=False, server_hostname=server_sni_hostname)
conn.connect((host_addr, host_port))
conn.send(b"Hello, world!")
conn.close()
This works, but I want to send different requests to some path, e.g. /rest/v1/fill.
So, I decided to use requests or urllib3 lib.
I'm trying to pass certificates to this libs
https = urllib3.PoolManager(cert_file=client_cert, cert_reqs='CERT_REQUIRED', ca_certs=server_cert, key_file=client_key)
https.request('GET', 'https://localhost:8082/rest/v1/fill')
but client hangs with both of libs:
/home/marat/.local/lib/python3.6/site-packages/urllib3/connection.py:362: SubjectAltNameWarning: Certificate for localhost has no `subjectAltName`, falling back to check for a `commonName` for now. This feature is being removed by major browsers and deprecated by RFC 2818. (See https://github.com/shazow/urllib3/issues/497 for details.)
SubjectAltNameWarning
^CTraceback (most recent call last):
File "/home/marat/.local/lib/python3.6/site-packages/urllib3/connectionpool.py", line 377, in _make_request
httplib_response = conn.getresponse(buffering=True)
TypeError: getresponse() got an unexpected keyword argument 'buffering'
server's output:
Client connected: 127.0.0.1:40026
SSL established. Peer: {'subject': ((('countryName', 'US'),), (('stateOrProvinceName', 'Denial'),), (('localityName', 'Springfield'),), (('organizationName', 'Dis'),), (('commonName', 'localhost'),), (('userId', 'testnotifier'),)), 'issuer': ((('countryName', 'US'),), (('stateOrProvinceName', 'Denial'),), (('localityName', 'Springfield'),), (('organizationName', 'Dis'),), (('commonName', 'localhost'),), (('userId', 'testnotifier'),)), 'version': 3, 'serialNumber': '88F15B15B2D1ABE7', 'notBefore': 'Jun 5 11:35:38 2019 GMT', 'notAfter': 'Jun 4 11:35:38 2020 GMT'}
Received: b'GET / HTTP/1.1\r\nHost: localhost:8082\r\nAccept-Encoding: identity\r\n\r\n'
Closing connection
I would like to know how to pass certificates so that the client works as in the first version (with socket/ssl).
I worked incorrectly with certificates.
So, bash script for generate certificates:
generate_test_certs() {
echo "Generate test certs"
mkdir -p ${SCRIPT_PATH}/test/certs/{server,client,root}
local certs=${SCRIPT_PATH}/test/certs
local CN=localhost # common name
cat <<EOF > ${certs}/openssl.cnf
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = #alt_names
[alt_names]
DNS.1 = ${CN}
EOF
# Create root key
openssl genrsa -out ${certs}/root/rootCA.key 2048
openssl req -new -x509 -days 3650 -key ${certs}/root/rootCA.key -out ${certs}/root/rootCA.crt \
-subj "/C=US/ST=Denial/L=Springfield/O=Qwerty Inc./OU=Qwerty Operations/CN=Qwerty Root"
# Generate sign request
openssl req -new -newkey rsa:2048 -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=${CN}/UID=testnotifier" \
-keyout ${certs}/server/server.key -nodes -out ${certs}/server/server.csr
# Sign CSR by ROOT CA certificate
openssl x509 -req -days 3650 -in ${certs}/server/server.csr -CA ${certs}/root/rootCA.crt \
-CAkey ${certs}/root/rootCA.key -set_serial 01 -out ${certs}/server/server.crt \
-extfile ${certs}/openssl.cnf
# Generate client certificate
openssl req -new -newkey rsa:2048 -nodes -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=${CN}/UID=testnotifier" \
-keyout ${certs}/client/client.key -out ${certs}/client/client.csr
openssl x509 -req -days 3650 -in ${certs}/client/client.csr -CA ${certs}/root/rootCA.crt -CAkey ${certs}/root/rootCA.key \
-set_serial 01 -out ${certs}/client/client.crt
}
Nginx config for example:
server {
listen 451 ssl;
server_name tester;
ssl_certificate ../../../test/certs/server/server.crt;
ssl_certificate_key ../../../test/certs/server/server.key;
ssl_client_certificate ../../../test/certs/root/rootCA.crt;
ssl_verify_client optional;
ssl_verify_depth 3;
include ../../../conf/tester.rules.conf;
}
And finally python client
#!/usr/bin/python3
import requests
root_ca = 'certs/root/rootCA.crt'
client_cert = 'certs/client/client.crt'
client_key = 'certs/client/client.key'
resp = requests.get('https://localhost:451/qwe/rty',
cert=(client_cert, client_key), verify=root_ca)
print(resp.status_code)
print(resp.content)

Decrypting openssl aes-256-cbc using node.js?

I'm encrypting my file on the command line using:
openssl aes-256-cbc -e -in test.env -out test.env.encrypted
and then trying to decrypt on node.js with:
crypto = require('crypto')
algorithm = 'aes-256-cbc'
password = 'test'
fs = require 'fs'
decrypt = (text) ->
decipher = crypto.createDecipher(algorithm, password)
dec = decipher.update(text, 'hex', 'utf8')
dec += decipher.final('utf8')
dec
file = fs.readFileSync './test.env.encrypted', 'utf-8'
console.log decrypt file
But i'm getting the following error:
TypeError: Bad input string at Decipher.update (crypto.js:168:26) at decrypt (/Users/h/tmp/encrypt_test/test.coffee:10:18) at Object.<anonymous> (/Users/h/tmp/encrypt_test/test.coffee:16:13) at Object.<anonymous> (/Users/h/tmp/encrypt_test/test.coffee:1:1) at Module._compile (module.js:569:30) at Object.CoffeeScript.run (/usr/local/lib/node_modules/coffeescript/lib/coffeescript/index.js:63:23) at compileScript (/usr/local/lib/node_modules/coffeescript/lib/coffeescript/command.js:265:29) at compilePath (/usr/local/lib/node_modules/coffeescript/lib/coffeescript/command.js:220:14) at Object.exports.run (/usr/local/lib/node_modules/coffeescript/lib/coffeescript/command.js:141:20) at Object.<anonymous> (/usr/local/lib/node_modules/coffeescript/bin/coffee:15:45) at Module._compile (module.js:569:30) at Object.Module._extensions..js (module.js:580:10) at Module.load (module.js:503:32) at tryModuleLoad (module.js:466:12) at Function.Module._load (module.js:458:3) at Function.Module.runMain (module.js:605:10) at startup (bootstrap_node.js:158:16) at bootstrap_node.js:575:3
What am i doing wrong?
UPDATE:
As per James note i'm now sending a "hex" string to my decrypt function:
crypto = require('crypto')
algorithm = 'aes-256-cbc'
password = 'test'
fs = require 'fs'
decrypt = (text) ->
decipher = crypto.createDecipher(algorithm, password)
dec = decipher.update(text, 'hex', 'utf8')
dec += decipher.final('utf8')
dec
file = fs.readFileSync './test.env.encrypted'
console.log decrypt file.toString('hex')
But then it's yielding a new error:
Error: error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt
at Decipher.final (crypto.js:181:26)
at decrypt (/Users/h/tmp/encrypt_test/test.coffee:12:19)
at Object.<anonymous> (/Users/h/tmp/encrypt_test/test.coffee:17:13)
at Object.<anonymous> (/Users/h/tmp/encrypt_test/test.coffee:1:1)
at Module._compile (module.js:569:30)
at Object.CoffeeScript.run (/usr/local/lib/node_modules/coffeescript/lib/coffeescript/index.js:63:23)
at compileScript (/usr/local/lib/node_modules/coffeescript/lib/coffeescript/command.js:265:29)
at compilePath (/usr/local/lib/node_modules/coffeescript/lib/coffeescript/command.js:220:14)
at Object.exports.run (/usr/local/lib/node_modules/coffeescript/lib/coffeescript/command.js:141:20)
at Object.<anonymous> (/usr/local/lib/node_modules/coffeescript/bin/coffee:15:45)
at Module._compile (module.js:569:30)
at Object.Module._extensions..js (module.js:580:10)
at Module.load (module.js:503:32)
at tryModuleLoad (module.js:466:12)
at Function.Module._load (module.js:458:3)
at Function.Module.runMain (module.js:605:10)
at startup (bootstrap_node.js:158:16)
at bootstrap_node.js:575:3
File was encrypted using:
openssl aes-256-cbc -e -in test.env -out test.env.encrypted
with
test
as password
Your call to decipher.update expects a hex encoded string but you're passing a utf-8 string.
Either change your readFileSync to read with hex encoding or change the update call to expect utf-8 input.

Client certificate validation on server side, DEPTH_ZERO_SELF_SIGNED_CERT error

I'm using node 0.10.26 and trying to establish https connection with client validation.
Server's code:
var https = require('https');
var fs = require('fs');
process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
var options = {
key: fs.readFileSync('ssl/server1.key'),
cert: fs.readFileSync('ssl/server1.pem'),
requestCert: true,
rejectUnauthorized: false,
};
var server = https.createServer(options, function (req, res) {
if (req.client.authorized) {
res.writeHead(200, {"Content-Type":"application/json"});
res.end('{"status":"approved"}');
console.log("Approved Client ", req.client.socket.remoteAddress);
} else {
console.log("res.connection.authroizationError: " + res.connection.authorizationError);
res.writeHead(403, {"Content-Type":"application/json"});
res.end('{"status":"denied"}');
console.log("Denied Client " , req.client.socket.remoteAddress);
}
});
server.on('error', function(err) {
console.log("server.error: " + err);
});
server.on("listening", function () {
console.log("Server listeining");
});
server.listen(5678);
Client's code:
var https = require('https');
var fs = require('fs');
var options = {
host: 'localhost',
port: 5678,
method: 'GET',
path: '/',
headers: {},
agent: false,
key: fs.readFileSync('ssl/client2.key'),
cert: fs.readFileSync('ssl/client2.pem'),
ca: fs.readFileSync('ssl/ca.pem')
};
process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
var req = https.request(options, function(res) {
console.log(res.req.connection.authorizationError);
});
req.on("error", function (err) {
console.log('error: ' + err);
});
req.end();
I've created certificates with following commands, each time providing result of "uname -n" as "Common Name":
openssl genrsa -out ca.key 4096
openssl req -x509 -new -nodes -key ca.key -days 999 -out ca.pem
openssl genrsa -out server1.key 1024
openssl req -new -key server1.key -out server1.csr
openssl x509 -req -days 999 -in server1.csr -CA ca.pem -CAkey ca.key -set_serial 01 -out server1.pem
openssl genrsa -out client1.key 1024
openssl req -new -key client1.key -out client1.csr
openssl x509 -req -days 999 -in client1.csr -CA ca.pem -CAkey ca.key -set_serial 01 -out client1.pem
openssl genrsa -out server2.key 1024
openssl req -new -key server2.key -out server2.csr
openssl x509 -req -days 999 -in server2.csr -CA server1.pem -CAkey server1.key - set_serial 02 -out server2.pem
openssl genrsa -out client2.key 1024
openssl req -new -key client2.key -out client2.csr
openssl x509 -req -days 999 -in client2.csr -CA client1.pem -CAkey client1.key -set_serial 02 -out client2.pem
I've run client and server with all compbinations of client's and server's certificates (that is: [(server1, client1), (server1, client2), (server2, client1), (server2, client2)] and for each combination of those server was tested both with default value of "agent" field and with "agent" set to "false".
Each time I ran client.js, res.req.connection.authorizationError was set to DEPTH_ZERO_SELF_SIGNED_CERT.
How can I establish secure connection in node with client's certificate authentication?
I believe you have two problems, one with your code and one with your certificates.
The code issue is in your server. You are not specifying the CA to check client certificates with an options property like you have in your client code:
ca: fs.readFileSync('ssl/ca.pem'),
The second problem is the one that really causes that DEPTH_ZERO_SELF_SIGNED_CERT error. You are giving all your certificates - CA, server, and client - the same Distinguished Name. When the server extracts the issuer information from the client certificate, it sees that the issuer DN is the same as the client certificate DN and concludes that the client certificate is self-signed.
Try regenerating your certificates, giving each one a unique Common Name (to make the DN also unique). For example, name your CA certificate "Foo CA", your server certificate the name of your host ("localhost" in this case), and your client something else (e.g. "Foo Client 1").
For those of that want to use a self-signed certificate, the answer is to add rejectUnauthorized: false to the https.request options.
This one worked for me:
process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
Note: Posting answer so it can help others in future.
Just add strictSSL: false to your options.
Despite of long lines of description in this page, I still got 'UNABLE_TO_VERIFY_LEAF_SIGNATURE' error in the client side with this recipe. Maybe I had something wrong in following rhashimoto's comment.
By referencing book of 'Professional Node.js', I found another way to test HTTPS with Client Certificate Verification successfully.
Here is my story.
By setting requestCert: true in server side, the server tries to validate client certificate. But the default CA doesn't validate the self-signed certificate of the client. I can succeed the test with simple trick -- copy the client certificate and say that is a Certificate Authority.
I reused original code and modified it slightly to make it work.
The big difference is in creating certificate files.
Creating certificate files:
# create client private key
openssl genrsa -out client2.key
openssl req -new -key client2.key -out client2.csr
# create client certificate
openssl x509 -req -in client2.csr -signkey client2.key -out client2.pem
# create server private key and certificate
openssl genrsa -out server1.key
openssl req -new -key server1.key -out server1.csr
openssl x509 -req -in server1.csr -signkey server1.key -out server1.pem
# * Important *: create fake CA with client certificate for test purpose
cp client2.pem fake_ca.pem
Server code:
var options = {
key: fs.readFileSync('ssl/server1.key'),
cert: fs.readFileSync('ssl/server1.pem'),
ca: [fs.readFileSync('ssl/fake_ca.pem')], // Line added
requestCert: true,
rejectUnauthorized: false,
};
Client code:
key: fs.readFileSync('ssl/client2.key'),
cert: fs.readFileSync('ssl/client2.pem'),
//ca: fs.readFileSync('ssl/ca.pem') // Line commented
};
process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
var req = https.request(options, function(res) {
//console.log(res.req.connection.authorizationError);
console.log("statusCode:", res.statusCode);
res.on('data', function(d) {
console.log('data:', d.toString());
});
});
req.on("error", function (err) {
console.log('error: ' + err);
});
req.end();
As mentioned above, there is a sledgehammer to hammer in your nail, using rejectUnauthorized: false.
A more sensible option, from a security point of view, would be to ask the user if (s)he would like to accept and store the self-signed server certificate, just like a browser (or SSH) does.
That would require:
(1) That NodeJS throws an exception that contains the server certificate, and
(2) that the application calls https.request with the stored certificate in the ca: property (see above for description of ca) after the certificate has been manually accepted.
It seems that NodeJS does not do (1), making (2) impossible?
Even better from a security point of view would be to use EFF's SSL observatory to make a crowd-sourced judgement on the validity of a self-signed certificate. Again, that requires NodeJS to do (1).
I think a developer needs to improve NodeJS with respect to (1)...
If you have only a .pem self-signed certificate (e.g. /tmp/ca-keyAndCert.pem) the following options will work:
var options = {
url: 'https://<MYHOST>:<MY_PORT>/',
key: fs.readFileSync('/tmp/ca-keyAndCert.pem'),
cert: fs.readFileSync('/tmp/ca-keyAndCert.pem'),
requestCert: false,
rejectUnauthorized: false
};

Resources