Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

unable to load Public Key
4343219756:error:0DFFF0A8:asn1 encoding routines:CRYPTO_internal:wrong tag:/AppleInternal/Library/BuildRoots/a0876c02-1788-11ed-b9c4-96898e02b808/Library/Caches/com.apple.xbs/Sources/libressl/libressl-2.8/crypto/asn1/tasn_dec.c:1144:
4343219756:error:0DFFF03A:asn1 encoding routines:CRYPTO_internal:nested asn1 error:/AppleInternal/Library/BuildRoots/a0876c02-1788-11ed-b9c4-96898e02b808/Library/Caches/com.apple.xbs/Sources/libressl/libressl-2.8/crypto/asn1/tasn_dec.c:317:Type=X509_ALGOR
4343219756:error:0DFFF03A:asn1 encoding routines:CRYPTO_internal:nested asn1 error:/AppleInternal/Library/BuildRoots/a0876c02-1788-11ed-b9c4-96898e02b808/Library/Caches/com.apple.xbs/Sources/libressl/libressl-2.8/crypto/asn1/tasn_dec.c:646:Field=algor, Type=X509_PUBKEY

I followed these steps "https://aws.amazon.com/fr/blogs/security/how-to-verify-aws-kms-asymmetric-key-signatures-locally-with-openssl/".

Expected Behavior

Generated a file inst.pem without error.

How are you starting LocalStack?

With a docker-compose file

Steps To Reproduce

How are you starting localstack (e.g., bin/localstack command, arguments, or docker-compose.yml)

version: '3.2'

networks:
netapp:

services:
localstack:
image: localstack/localstack:1.2
environment:
AWS_ENDPOINT: "http://localstack:4566"
SERVICES: lambda,apigateway,iam,s3,dynamodb,sts,cloudwatch,events,kms,ssm,kinesis,logs,sns,sqs,secretsmanager
LAMBDA_EXECUTOR: docker
DOCKER_HOST: unix:///var/run/docker.sock
LAMBDA_CONTAINER_REGISTRY: "lambci/lambda"
LAMBDA_REMOTE_DOCKER: "true"
LAMBDA_DOCKER_NETWORK: netapp
HOSTNAME_EXTERNAL: localstack
EDGE_PORT: 4566
DEBUG: 1
ports:
- 4566:4566
volumes:
- /var/run/docker.sock:/var/run/docker.sock

Client commands (e.g., AWS SDK code snippet, or sequence of "awslocal" commands)

1. Run AWS_REGION=eu-west-3 AWS_ACCESS_KEY_ID=fake AWS_SECRET_ACCESS_KEY=fake aws --endpoint-url="http://localhost:4566" kms create-key --customer-master-key-spec="RSA_2048" --key-usage="SIGN_VERIFY" --description="test1839"
2. Take the value of "KeyMetadata.KeyId"
3. Run AWS_REGION=eu-west-3 AWS_ACCESS_KEY_ID=fake AWS_SECRET_ACCESS_KEY=fake aws --endpoint-url="http://localhost:4566" kms get-public-key --key-id [keyid] --output text --query PublicKey | base64 -d > inst.der
4. Run openssl rsa -pubin -inform DER -outform PEM -in inst.der -pubout -out inst.pem

Then you obtains this result

I followed these steps "https://aws.amazon.com/fr/blogs/security/how-to-verify-aws-kms-asymmetric-key-signatures-locally-with-openssl/".

I have the version 1.2.0 of localstack, arch arm64.

Environment

- OS: macOs Montery 12.6.1 (MacBook Air (M1, 2020)
- Chip: Apple M1
- Memory: 16 GB
- LocalStack: 1.2.0

Anything else?

It works with the current original AWS.

We started to investigate when the error "x509: malformed tbs certificate" appers in our logs from our application in go.