fix: pkcs11 generate correct CSR signature#3737
Merged
Bravo555 merged 3 commits intothin-edge:mainfrom Jul 22, 2025
Merged
Conversation
Signed-off-by: Marcel Guzik <marcel.guzik@cumulocity.com>
Codecov ReportAttention: Patch coverage is 📢 Thoughts on this report? Let us know! 🚀 New features to boost your workflow:
|
Contributor
Robot Results
|
Add a `sign2` function that allows the caller to select a signature scheme to use when signing. This was previously thought unnecessary because EC keys each only support a single signature scheme and for RSA keys using RSA-PSS signatures is recommended so when only using RSA-PSS each RSA key also would have only a single signature scheme, but when generating CSRs, we actually need to use PKCS 1.5 signatures because rcgen doesn't support RSA-PSS yet. Signed-off-by: Marcel Guzik <marcel.guzik@cumulocity.com>
3c70db2 to
c6000b0
Compare
jarhodes314
reviewed
Jul 21, 2025
| rustls::SignatureScheme::ECDSA_NISTP521_SHA512 => SigScheme::EcdsaNistp521Sha512, | ||
| rustls::SignatureScheme::RSA_PSS_SHA256 => SigScheme::RsaPssSha256, | ||
| rustls::SignatureScheme::RSA_PKCS1_SHA256 => SigScheme::RsaPkcs1Sha256, | ||
| _ => todo!(), |
Contributor
There was a problem hiding this comment.
If we can't map all possible source values to a valid target value here, this should probably be a TryFrom
Member
Author
There was a problem hiding this comment.
fixed in 08af0dc by directly using SigScheme instead of rustls::SignatureScheme and converting to SigScheme, so the partial From implementation was entirely removed
jarhodes314
approved these changes
Jul 22, 2025
Make the signer use a PKCS 1.5 signature when signing CSRs instead of currently used RSA-PSS. The signature generated so far was invalid because, when generating a CSR with a private key on a PKCS11 token, and if that key was an RSA key, the signer signed the CSR using RSA-PSS signature scheme, but the SignatureAlgorithm identifier in the CSR indicated that the signature was a PKCS 1.5 signature. This was previously unnoticed because Cumulocity did not verify CSR signature is correct when renewing, but as of time of making this fix, Cumulocity now correctly verifies the signatures. Signed-off-by: Marcel Guzik <marcel.guzik@cumulocity.com>
1c23b1a to
3f1ef44
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed changes
Make the signer use a PKCS 1.5 signature when signing CSRs instead of currently used RSA-PSS.
The signature generated so far was invalid because, when generating a CSR with a private key on a PKCS11 token, and if that key was an RSA key, the signer signed the CSR using RSA-PSS signature scheme, but the SignatureAlgorithm identifier in the CSR indicated that the signature was a PKCS 1.5 signature.
This was previously unnoticed because Cumulocity did not verify CSR signature is correct when renewing, but as of time of making this fix, Cumulocity now correctly verifies the signatures.
Types of changes
Paste Link to the issue
Checklist
just prepare-devonce)just formatas mentioned in CODING_GUIDELINESjust checkas mentioned in CODING_GUIDELINESFurther comments