I am trying to push my docker image to Google Cloud Registry but get a 509 error say the certificate signed by unknown authority. This never used to be a problem and I can't seem to fix the issue. Any help is appreciated.
I'm running
docker -- push gcp.io/project/registry
Error
Get https://gcp.io/v2/: x509: certificate signed by unknown authority
I'm on Mac OS.
Update: you have a typo, you need to go to gcr.io, not gcp.io.
[ Original answer ]
Looks like a certificate issue on gcp.io:
$ openssl s_client -showcerts -connect gcp.io:443 </dev/null
CONNECTED(00000003)
depth=0 OU = Domain Control Validated, OU = PositiveSSL Wildcard, CN = *.gcp.io
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 OU = Domain Control Validated, OU = PositiveSSL Wildcard, CN = *.gcp.io
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
0 s:OU = Domain Control Validated, OU = PositiveSSL Wildcard, CN = *.gcp.io
i:C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Domain Validation Secure Server CA
-----BEGIN CERTIFICATE-----
MIIF6jCCBNKgAwIBAgIRAPLbl+CLddoCWmMcKSzPAT8wDQYJKoZIhvcNAQELBQAw
gY8xCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAO
BgNVBAcTB1NhbGZvcmQxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE3MDUGA1UE
AxMuU2VjdGlnbyBSU0EgRG9tYWluIFZhbGlkYXRpb24gU2VjdXJlIFNlcnZlciBD
QTAeFw0xOTExMjUwMDAwMDBaFw0yMDExMjQyMzU5NTlaMFUxITAfBgNVBAsTGERv
bWFpbiBDb250cm9sIFZhbGlkYXRlZDEdMBsGA1UECxMUUG9zaXRpdmVTU0wgV2ls
ZGNhcmQxETAPBgNVBAMMCCouZ2NwLmlvMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEAozq94VQqkxLR0qUqz6IM5/lY411MkLgrQhOR8Sg17EioEpudFKCV
FhC9N2Z8EFLpaGAxABpYM5JLWy1PpszOEETFswaS0Y/CpCnzW/SXtlH2ZOlGBXII
3LKP7ScfCgbwnndg820cA0XDNc54MUZcx2ebe2MZfFHKNhm+Lpqr4UZZu4ZaE8C6
9tcJaMC/znIWUpf+61aUJIQTYITL+NVB3zCeDhK0r29aLbz4K33TqN+9PJtwyTiS
8PZFTg93R8RCzdJD6x1lg3u7tAHGi6S3Omn7y3YtivTsA3iYbYIBm9i+0EHgpTOA
Hp9Z3wX2TF/M6FiY7yo1tc8ft6i3wICaUwIDAQABo4ICeDCCAnQwHwYDVR0jBBgw
FoAUjYxexFStiuF36Zv5mwXhuAGNYeEwHQYDVR0OBBYEFH7PsGxNUFi1gLyOjwje
oEXcFIIuMA4GA1UdDwEB/wQEAwIFoDAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQG
CCsGAQUFBwMBBggrBgEFBQcDAjBJBgNVHSAEQjBAMDQGCysGAQQBsjEBAgIHMCUw
IwYIKwYBBQUHAgEWF2h0dHBzOi8vc2VjdGlnby5jb20vQ1BTMAgGBmeBDAECATCB
hAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28u
Y29tL1NlY3RpZ29SU0FEb21haW5WYWxpZGF0aW9uU2VjdXJlU2VydmVyQ0EuY3J0
MCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTAbBgNVHREEFDAS
gggqLmdjcC5pb4IGZ2NwLmlvMIIBBAYKKwYBBAHWeQIEAgSB9QSB8gDwAHUAB7dc
G+V9aP/xsMYdIxXHuuZXfFeUt2ruvGE6GmnTohwAAAFuouNwEgAABAMARjBEAiAB
bpCCsd9bTM4mJMAEVf9WL4Mu3z+EaezOfJ+1N5MzEAIgHcuRkKk/tukyDAz0gZtu
z1K87zVaw96FUdFbLQnZw0YAdwBep3P531bA57U2SH3QSeAyepGaDIShEhKEGHWW
gXFFWAAAAW6i42//AAAEAwBIMEYCIQCL81nEy3BBlmVR5ehK+LgAvWUxlwWUoTtH
+TLgft+usgIhALCoeeBaEkcMTPIU+fmQQ6FTp7tMvzN726bHJ/ODJZmEMA0GCSqG
SIb3DQEBCwUAA4IBAQBBnaYdC4OjT0rjlVYRR5lqiRsHTgQiReJXVwXtYO6czPYU
np1szzpF0xto3lTImJNzyyWl8Zt+4H/ABrOE3aKlnpQVZ/nBPqx8cLI/O8kEl6o4
rQxCXfVum3LTHqO0EtFSQfC3ALS137afCKUGa/e4PlFNTMqStP/anhv6byK+0bwh
jiqd9xuhjLmttf6zDelcmZPAZFuSL34khKnILPiXBsbiKFULiY1yEdpc4IpNLvZD
ys46g64+ss0sIqYR3vDPdoQmY3SUutxL7m2fwElGKGJIMFvkJ4+TUvNqAIsyQuEt
sIp/puDi8aEFhExywY1zrAeUuj4CJrCsHKZ25IIg
-----END CERTIFICATE-----
1 s:C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority
i:C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN = AddTrust External CA Root
-----BEGIN CERTIFICATE-----
MIIFdzCCBF+gAwIBAgIQE+oocFv07O0MNmMJgGFDNjANBgkqhkiG9w0BAQwFADBv
MQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFk
ZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBF
eHRlcm5hbCBDQSBSb290MB4XDTAwMDUzMDEwNDgzOFoXDTIwMDUzMDEwNDgzOFow
gYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtK
ZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYD
VQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIICIjAN
BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgBJlFzYOw9sIs9CsVw127c0n00yt
UINh4qogTQktZAnczomfzD2p7PbPwdzx07HWezcoEStH2jnGvDoZtF+mvX2do2NC
tnbyqTsrkfjib9DsFiCQCT7i6HTJGLSR1GJk23+jBvGIGGqQIjy8/hPwhxR79uQf
jtTkUcYRZ0YIUcuGFFQ/vDP+fmyc/xadGL1RjjWmp2bIcmfbIWax1Jt4A8BQOujM
8Ny8nkz+rwWWNR9XWrf/zvk9tyy29lTdyOcSOk2uTIq3XJq0tyA9yn8iNK5+O2hm
AUTnAU5GU5szYPeUvlM3kHND8zLDU+/bqv50TmnHa4xgk97Exwzf4TKuzJM7UXiV
Z4vuPVb+DNBpDxsP8yUmazNt925H+nND5X4OpWaxKXwyhGNVicQNwZNUMBkTrNN9
N6frXTpsNVzbQdcS2qlJC9/YgIoJk2KOtWbPJYjNhLixP6Q5D9kCnusSTJV882sF
qV4Wg8y4Z+LoE53MW4LTTLPtW//e5XOsIzstAL81VXQJSdhJWBp/kjbmUZIO8yZ9
HE0XvMnsQybQv0FfQKlERPSZ51eHnlAfV1SoPv10Yy+xUGUJ5lhCLkMaTLTwJUdZ
+gQek9QmRkpQgbLevni3/GcV4clXhB4PY9bpYrrWX1Uu6lzGKAgEJTm4Diup8kyX
HAc/DVL17e8vgg8CAwEAAaOB9DCB8TAfBgNVHSMEGDAWgBStvZh6NLQm9/rEJlTv
A73gJMtUGjAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/
BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wEQYDVR0gBAowCDAGBgRVHSAAMEQGA1Ud
HwQ9MDswOaA3oDWGM2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9BZGRUcnVzdEV4
dGVybmFsQ0FSb290LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0
dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggEBAJNl9jeD
lQ9ew4IcH9Z35zyKwKoJ8OkLJvHgwmp1ocd5yblSYMgpEg7wrQPWCcR23+WmgZWn
RtqCV6mVksW2jwMibDN3wXsyF24HzloUQToFJBv2FAY7qCUkDrvMKnXduXBBP3zQ
YzYhBx9G/2CkkeFnvN4ffhkUyWNnkepnB2u0j4vAbkN9w6GAbLIevFOFfdyQoaS8
Le9Gclc1Bb+7RrtubTeZtv8jkpHGbkD4jylW6l/VXxRTrPBPYer3IsynVgviuDQf
Jtl7GQVoP7o81DgGotPmjw7jtHFtQELFhLRAlSv0ZaBIefYdgWOWnU914Ph85I6p
0fKtirOMxyHNwu8=
-----END CERTIFICATE-----
---
Server certificate
subject=OU = Domain Control Validated, OU = PositiveSSL Wildcard, CN = *.gcp.io
issuer=C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Domain Validation Secure Server CA
---
No client certificate CA names sent
Peer signing digest: SHA512
Peer signature type: RSA
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 3435 bytes and written 424 bytes
Verification error: unable to verify the first certificate
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES128-GCM-SHA256
Session-ID: A1FB2B7B405094705F0DAFCAABA63B4E1ABDE5C122F2F3E5A7DE88ECB75AB617
Session-ID-ctx:
Master-Key: A0FB112FC9A33BD96E2346627A4E99A03F5C8AA404B19215EA3226A487B034E17EAC38AE0BD79C6B51E882BDC0DECE90
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1588527367
Timeout : 7200 (sec)
Verify return code: 21 (unable to verify the first certificate)
Extended master secret: no
---
DONE
And I see a similar error from curl -v https://gcp.io/v2/. This will need to be resolved by Google.
Im automating nmap using python , i like to get some specific value from the results, which is a string
PORT STATE SERVICE
443/tcp open https
| ssl-cert: Subject: commonName=*.google.com/organizationName=Google LLC/stateOrProvinceName=California/countryName=US
| Subject Alternative Name: DNS:*.google.com, DNS:*.android.com, DNS:*.appengine.google.com, DNS:*.cloud.google.com, DNS:*.crowdsource.google.com, DNS:*.g.co, DNS:*.gcp.gvt2.com, DNS:*.gcpcdn.gvt1.com, DNS:*.ggpht.cn, DNS:*.gkecnapps.cn, DNS:*.google-analytics.com, DNS:*.google.ca, DNS:*.google.cl, DNS:*.google.co.in, DNS:*.google.co.jp, DNS:*.google.co.uk, DNS:*.google.com.ar, DNS:*.google.com.au, DNS:*.google.com.br, DNS:*.google.com.co, DNS:*.google.com.mx, DNS:*.google.com.tr, DNS:*.google.com.vn, DNS:*.google.de, DNS:*.google.es, DNS:*.google.fr, DNS:*.google.hu, DNS:*.google.it, DNS:*.google.nl, DNS:*.google.pl, DNS:*.google.pt, DNS:*.googleadapis.com, DNS:*.googleapis.cn, DNS:*.googlecnapps.cn, DNS:*.googlecommerce.com, DNS:*.googlevideo.com, DNS:*.gstatic.cn, DNS:*.gstatic.com, DNS:*.gstaticcnapps.cn, DNS:*.gvt1.com, DNS:*.gvt2.com, DNS:*.metric.gstatic.com, DNS:*.urchin.com, DNS:*.url.google.com, DNS:*.wear.gkecnapps.cn, DNS:*.youtube-nocookie.com, DNS:*.youtube.com, DNS:*.youtubeeducation.com, DNS:*.youtubekids.com, DNS:*.yt.be, DNS:*.ytimg.com, DNS:android.clients.google.com, DNS:android.com, DNS:developer.android.google.cn, DNS:developers.android.google.cn, DNS:g.co, DNS:ggpht.cn, DNS:gkecnapps.cn, DNS:goo.gl, DNS:google-analytics.com, DNS:google.com, DNS:googlecnapps.cn, DNS:googlecommerce.com, DNS:source.android.google.cn, DNS:urchin.com, DNS:www.goo.gl, DNS:youtu.be, DNS:youtube.com, DNS:youtubeeducation.com, DNS:youtubekids.com, DNS:yt.be
| Issuer: commonName=GTS CA 1O1/organizationName=Google Trust Services/countryName=US
| Public Key type: unknown
| Public Key bits: 256
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2020-03-03T09:45:25
| Not valid after: 2020-05-26T09:45:25
| MD5: bda3 4bfa 9f3d 5091 14a2 4a0e 992b 183f
|_SHA-1: 12b0 59d4 f6fb cd67 5013 a49e 44cf 053f d773 a07f
my method return issuer,public key and public key bit and signature algorithm but with the rest of string output
def run_command():
command ="nmap -p 443 --script ssl-cert google.com"
output = subprocess.getoutput(command)
Issuer= output.split("Issuer: ",1)[1]
public_key = output.split("Public Key type: ",1)[1]
public_key_bit= output.split("Public Key bits: ",1)[1]
singature_algor = output.split("Signature Algorithm: ",1)[1]
print(Issuer,public_key,public_key_bit,singature_algor)
the wanted results, just to print the value of each of these values bellow
Issuer: commonName=GTS CA 1O1/organizationName=Google Trust Services/countryName=US
Public Key type: unknown
Public Key bits: 256
Signature Algorithm: sha256WithRSAEncryption
I manage to find a way
def verify_certificate(self,to_check):
command ="nmap -p 443 --script ssl-cert google.com"
output = subprocess.getoutput(command)
line = re.findall(to_check+":.*$", output, re.MULTILINE)
for x in line:
results = x.split(to_check+":",1)[1]
print(results)
output
commonName=GTS CA 1O1/organizationName=Google Trust Services/countryName=US
and by changing to_check value, I get the other values as well without duplicate code.
I have an express instance and an unencrypted pfx which contains my cert and an encrypted private key. When I load the pfx in express, I do not need to provide any sort of password, and it works. How is the node.js instance getting access to the private key? Isnt access to the unencrypted private key needed for https to work?
express code:
var httpsOptions = {
'pfx': fs.readfileSync('./cert.pfx'),
'passphrase': ''
};
https.createServer(httpsOptions, expressApp).listen(443, 'example.com');
My .pfx info from openSSL looks like the following:
openssl pkcs12 -in cert.pfx -info
MAC Iteration 2048
MAC verified OK
PKCS7 Encrypted data: XXXXXXXXXXXX, Iteration 2048
Certificate bag
Bag Attributes
localKeyID: XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX
subject=/OU=Domain Control Validated/CN=*.example.com
issuer=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com,
Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure
Certificate Authority - G2
-----BEGIN CERTIFICATE-----
XXXXXXXXXXX=
-----END CERTIFICATE-----
PKCS7 Data
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048
Bag Attributes
localKeyID: XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX
Key Attributes: <No Attributes>
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,XXXXXXXXXXX
XXXXXXXXXXXXXXXX==
-----END RSA PRIVATE KEY-----
Turns out both the pfx itself and the private key within the pfx were stored unencrypted.
I mistakenly thought the private key within the pfx was encrypted because 1.) I was told it was and
2.) and because the openSSL package will not display the raw private key unless explicitly told to with the -nodes option
when openssl displays Enter PEM pass phrase: as it did above, it was asking for how to encrypt the displayed output: not how to decrypt the stored key, as I originally thought
The correct command I was looking for above was
openssl pkcs12 -in cert.pfx -info -nodes
I'm in the process of re-emit a ROOT CA (Certification Authority) to fix some information in its fields, but you can imagine that it could be the same if the root Certificate is near to caducity time.
Of course, before do it in production, I 'm doing this in a test enviroment with a easy command line test (in linux).
I used the very good information I've found here Certification authority root certificate expiry and renewal.
I modify the process to make more similar to my own.
I've create a openssl_root.cnf file. I added some fields like
countryName = optional
organizationName = optional
organizationalUnitName = optional
localityName = optional
stateOrProvinceName = optional
telephoneNumber = optional
mail = optional
serialNumber = optional
commonName = optional
and of course, the parameter to ask (for example)
[ req_distinguished_name ]
mail = Email Address
mail_max = 60
telephoneNumber = Please submit yor Telf. Number
telephoneNumber_max = 13
...
the section which is more important to me, the extensions
[root_ca]
# Extensions for a typical CA RAIZ
# It's a CA certificate
basicConstraints = critical, CA:true, pathlen:1
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid
keyUsage = cRLSign, keyCertSign
subjectAltName = DNS.1:mycompany.com,
issuerAltName = issuer:copy
# CRLs & OCSP
crlDistributionPoints = #root_section
authorityInfoAccess = #ocsp_root
certificatePolicies = #PCs
[ root_section ]
URI.1 = https://$root_ip/crl/cacrl.crl
[ ocsp_root ]
caIssuers;URI.0 = http://$root_ip/certificates/cacert.pem
OCSP;URI.1 = http://$root_ip/ocsp
[ PCs ] #Certifification Policy section
policyIdentifier = 1.3.5.8 #fake OID
CPS.1 = http://$ip_local/dpc
CPS.2 = http://$ip_local/policy
userNotice.1 = #notice
after than I do the request with this commands
openssl genrsa -out ca.key 4096
openssl req -new -key ca.key -out ca.csr -config openssl_root.cnf -extensions root_ca -sha384
here I fill the fields of the DN with the information..
and so, I sign the root authority with
openssl ca -days 3650 -in ca.csr -keyfile ca.key -selfsign -create_serial -config openssl_root.cnf -extensions root_ca -out ca.pem
I have now ca.pem (the certificate) and ca.key (the private key)
now I create a Subordinate Certification Authority
openssl genrsa -out subca1.key 4096
obviously, I create a new section in the cnf file for the subordinate authority, name v3_ca
openssl req -new -key subca1.key -out subca1.csr -config openssl_root.cnf -extensions v3_ca -sha384
fill the fields and sign by
openssl ca -days 3650 -in subca1.csr -keyfile ca.key -cert ca.pem -config openssl_root.cnf -extensions v3_ca -out
I have now subca1.pem and subca1.key
If I test it
openssl verify -CAfile ca.pem -verbose subca1.pem
subca1.pem: OK
Now, I gonna do the new (re-newed) authority..
I MUST use the same private key ca.key...
openssl req -new -key ca.key -out newca.csr -config openssl_root.cnf -extensions root_ca -sha384
I put some information "updated" in the fields when fill the questionary, and sign
openssl ca -days 3650 -in newca.csr -keyfile ca.key -selfsign -create_serial -config openssl_root.cnf -extensions root_ca -out newca.pem
if I test now
subca1.pem: C = VE, O = empresa 1, OU = Gerencia Criptografia, L = La Urbina, ST = Miranda, telephoneNumber = 02129889977, mail = pki#empresa1.com, serialNumber = J123453450, CN = PSC Subordinado Empresa 1 PRUEBA
error 20 at 0 depth lookup:unable to get local issuer certificate
I review the public key and is the same, and the SubjectKeyIdentifier and AuthorityKeyIdentifier
openssl x509 -in ca.pem -pubkey -noout
-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxxG1bEsUyDU1X31qJJNC
7uBYQhRsNi0dgsvcrIruPiQAcg3pH8Pu/WdnDmIdn/OUV9IvMPa22BPm1zaLZ/HF
EkHJxGdThEpcCtsd2ET0KhqYQ21s78lCyQGMdJvmh/FBLuVBsd7IvxgARqTl2402
4HXv+PavFaANM5AO+UnEjXDHXI0ce560l8s+rivlDjoSZRNGBLEla0wl0Jf6oo8l
fV+m9zMbKsLvScXWsoq+aO6I5BY8WhJtU4vXRRjDVp5t4L6PCnHJpOFL6+jLxeJH
N83FEeNkjw681ZFoB6pFG2QdndzKK0hcRJb1+526GRY97sKBfCOkQgNsTjHoF2ST
SudbWarWmFZg4ofF6wNCt205q6siMJiNM9h67xFUwDFoUTav6m5GdCdgFdgBvODN
zSwc5e4V56bgh5Iyz7CZmTdAVxncy74EqJNV+PjcYnxei2Xb1BaenLyiLzZdk+OY
Wlp+6CQtebeU3nTZfNFpyV3XjkXpZJs5CGAgNTr9wRbtQxKbK/R+DOQoIk/b+g6s
3WfTJ8V7fktIX+vrdOe7vBayXh/Q5AEuNvGH4h0v+ziGZrIL68iTuQdDy/qrivtp
0AB4fVknp+q4ZOXGoLmWFDQjFBmzFFS7aZHCMhwRevp3F3jsWTgYDYEag6IeJVc/
ZH8VjHsthnkI6T/OlBVI3DsCAwEAAQ==
-----END PUBLIC KEY-----
openssl x509 -in newca.pem -pubkey -noout
-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxxG1bEsUyDU1X31qJJNC
7uBYQhRsNi0dgsvcrIruPiQAcg3pH8Pu/WdnDmIdn/OUV9IvMPa22BPm1zaLZ/HF
EkHJxGdThEpcCtsd2ET0KhqYQ21s78lCyQGMdJvmh/FBLuVBsd7IvxgARqTl2402
4HXv+PavFaANM5AO+UnEjXDHXI0ce560l8s+rivlDjoSZRNGBLEla0wl0Jf6oo8l
fV+m9zMbKsLvScXWsoq+aO6I5BY8WhJtU4vXRRjDVp5t4L6PCnHJpOFL6+jLxeJH
N83FEeNkjw681ZFoB6pFG2QdndzKK0hcRJb1+526GRY97sKBfCOkQgNsTjHoF2ST
SudbWarWmFZg4ofF6wNCt205q6siMJiNM9h67xFUwDFoUTav6m5GdCdgFdgBvODN
zSwc5e4V56bgh5Iyz7CZmTdAVxncy74EqJNV+PjcYnxei2Xb1BaenLyiLzZdk+OY
Wlp+6CQtebeU3nTZfNFpyV3XjkXpZJs5CGAgNTr9wRbtQxKbK/R+DOQoIk/b+g6s
3WfTJ8V7fktIX+vrdOe7vBayXh/Q5AEuNvGH4h0v+ziGZrIL68iTuQdDy/qrivtp
0AB4fVknp+q4ZOXGoLmWFDQjFBmzFFS7aZHCMhwRevp3F3jsWTgYDYEag6IeJVc/
ZH8VjHsthnkI6T/OlBVI3DsCAwEAAQ==
-----END PUBLIC KEY-----
is exactly the same...
But it doesn't match!
I guess the trouble maybe is in the SubjectKeyIdentifier and AuthorityKeyIdentifier but its match if I review both certificates,
Any help? Thanks
I am trying to convert der to pem using openssl M2Crypto library.
I am getting following exception for
p7 = SMIME.load_pkcs7_bio(raw_data)
Exception:
M2Crypto.SMIME.PKCS7_Error: 140605685806848:error:0D078089:asn1
encoding routines:ASN1_ITEM_EX_D2I:missing
eoc:tasn_dec.c:493:Type=PKCS7 140605685806848:error:0906700D:PEM
routines:PEM_ASN1_read_bio:ASN1 lib:pem_oth.c:83: