Bug #71050 [Com]: SubjectAltName (SAN) is Not included in openssl_csr_sign of a new CSR

Edit report at https://bugs.php.net/bug.php?id=71050&edit=1 ID: 71050 Comment by: doldev at snowgarden dot ch Reported by: jimmmaaay at hotmail dot com Summary: SubjectAltName (SAN) is Not included in openssl_csr_sign of a new CSR Status: Open Type: Bug Package: OpenSSL related Operating System: Windows & CentOS 6.7 PHP Version: 7.0.0 Block user comment: N Private report: N New Comment: The POC [1] reads the information for the certificate from the local config file. The POC is only an extended version which extract SAN the information from a CSR. You could easily adopt the script to meet your needs. The magic happens in this line => [2] [1] https://gist.github.com/dol/e9f3d682529ae7ee368f0e6862e16a87 [2] https://gist.github.com/dol/e9f3d682529ae7ee368f0e6862e16a87#file-cert-php-L34 Previous Comments: ------------------------------------------------------------------------ [2017-07-24 13:43:52] spam2 at rhsoft dot net DAMEND what do you think is the "You can finetune the CSR signing by configargs. See openssl_csr_new() for more information about configargs" supposed to do? there is *nothing* to copy from the CSR - openssl_csr_sign() is feeded *with a explicit openssl.conf file* and if you would look at what i posted you would see that and hence all your "I hope it clear that the certificate not automatically inherits all the x509 extensions from the CSR" is *nonsense* becaus eit is not asked to do so - it should read it from the *local config file* ------------------------------------------------------------------------ [2017-07-24 13:34:44] doldev at snowgarden dot ch I repeat myself. This is not a bug. The extensions are not automatically copied over from a CSR to the finale certificate. Please read this explanation [1] which summaries the problem and security issue quite well. To achieve the goal of signing a CSR with the SubjectAltName you may have to put some effort into. I put together an small POC [2] to illustrate a possible way. Please make sure you understand the security implications when receiving a CSR from a third party and then sign it. Make sure you validate and copy only the relevant x509 extension to the finale certificate. An other possibility is to use the sop/x509 library [3] (used in the POC) the construct you certificate. PS to Harald: Eine Auffrisching zum Thema Netiquette [4] würde dir sicherlich gut tun. [5] [1] https://github.com/chef-cookbooks/openssl/issues/37#issuecomment-259021438 [2] https://gist.github.com/dol/e9f3d682529ae7ee368f0e6862e16a87 [3] https://packagist.org/packages/sop/x509 [4] https://de.wikipedia.org/wiki/Netiquette [5] https://tools.ietf.org/html/rfc1855 ------------------------------------------------------------------------ [2017-07-24 09:50:36] spam2 at rhsoft dot net god damned $csr = openssl_csr_new($dn, $private_key, $key_config); $self_signed = openssl_csr_sign($csr, NULL, $private_key, 3650, $key_config); $key_config points with 'config' to a temporary "openssl.conf" and while the CSR has the SAN-Names the certificate does not and that means pretty sure that openssl_csr_sign() compoletly ignores the config file which is a MAJOR BUG __________________________________________ [ req ] distinguished_name = req_distinguished_name req_extensions = v3_req [ req_distinguished_name ] [ v3_req ] basicConstraints = CA:FALSE keyUsage = nonRepudiation, digitalSignature, keyEncipherment subjectAltName = @alt_names [ alt_names ] DNS.1 = www.test.rh DNS.2 = test.rh DNS.3 = test.thelounge.net __________________________________________ [csr] => Certificate Request: Data: Version: 0 (0x0) Subject: C=AT, ST=Vienna, L=Vienna, O=the lounge interactive design gmbh, OU=Administration, CN=www.test.rh Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (3072 bit) Modulus: 00:9c:2c:b0:19:42:50:83:ed:c7:5c:d8:f7:c3:f7: 13:d5:17:a5:01:37:40:9a:e5:7f:43:88:22:35:89: 41:1b:b6:73:d7:f5:91:92:a9:54:b7:51:72:80:ef: 85:22:df:ac:bc:87:d3:85:f6:8a:72:35:2c:b6:16: 5b:d5:24:cb:4d:0f:b7:95:05:52:61:4f:bd:68:d0: 8e:8d:b4:86:e0:0c:02:03:63:e2:01:44:8a:d3:52: 24:c0:c1:07:a2:30:b2:29:9d:6c:c6:54:6b:aa:40: d5:ac:6f:2c:e0:ea:8d:31:4e:e1:01:4c:3d:b0:27: 07:1b:c5:39:01:a3:e6:ad:a5:c6:b4:76:8a:2d:ab: 5c:a5:11:97:8a:f1:81:cd:ba:41:5f:88:34:a0:09: d3:80:7c:32:b7:1c:74:1f:84:a3:40:2c:54:08:b7: b6:08:f5:ad:34:0e:88:bb:c0:68:3f:04:f4:8f:0a: 09:bb:e4:6d:24:18:24:5f:62:73:d6:7a:d0:a2:c4: d4:b2:02:3b:92:50:c4:3f:a4:28:2c:b9:54:0c:b1: da:2d:d3:9a:fb:88:23:9f:46:3b:7b:8d:f4:c5:8f: 3b:af:b6:e1:98:26:fd:31:b4:da:bd:4f:31:52:8c: 86:1f:20:88:0c:c1:6d:3f:dd:ed:66:51:9e:99:a9: aa:82:2c:0d:2f:b1:39:70:e7:b3:e3:cb:af:54:7f: 02:f0:9d:eb:34:d3:d5:94:fd:30:58:15:3a:4b:67: a2:0b:40:30:35:ee:b7:50:81:8e:6e:3a:bb:76:25: fa:66:ed:3d:d1:ad:ed:2f:24:b8:0e:e2:f8:04:99: a6:25:96:4b:a9:84:c1:71:c0:7d:b1:b7:bd:c8:3b: 78:25:41:f6:76:69:aa:4b:4c:be:37:b8:e2:1b:ed: fc:25:31:b6:0c:39:47:22:4e:8b:df:8d:7a:86:81: ae:df:c0:3b:0d:bc:23:30:b9:5b:2e:a1:b8:89:f4: a4:dc:90:b2:eb:58:51:86:d0:b5 Exponent: 65537 (0x10001) Attributes: Requested Extensions: X509v3 Basic Constraints: CA:FALSE X509v3 Key Usage: Digital Signature, Non Repudiation, Key Encipherment X509v3 Subject Alternative Name: DNS:www.test.rh, DNS:test.rh, DNS:test.thelounge.net Signature Algorithm: sha256WithRSAEncryption 66:d0:4e:4d:6c:19:cc:c5:90:a4:2d:26:0d:9b:d4:12:80:d1: 8c:d6:7c:e5:9c:62:fc:66:66:6e:9c:53:da:a0:08:ff:9c:5e: 44:f9:a0:f8:fe:cd:82:66:9f:c2:38:d1:47:28:40:4e:08:6b: f2:a5:89:1b:36:25:3a:69:5b:20:e0:ee:eb:95:a4:69:2e:c9: a5:8d:4b:e7:1a:28:e8:b0:2f:27:78:b1:da:4f:cc:21:ed:93: 51:95:dd:77:f5:b9:b3:c6:cf:2b:3a:c8:b7:45:40:71:b3:11: 29:4d:d1:4e:2b:c4:b4:53:f7:e0:25:69:cf:90:4b:7a:7b:61: 9f:2e:75:2b:46:95:40:32:7b:8a:2f:f9:8d:e6:ed:e0:a2:1e: de:67:15:fe:96:18:3c:7a:33:6b:6f:24:55:1e:8f:bc:7c:47: 6e:bd:47:ab:5b:44:d9:62:84:39:87:71:05:69:95:5e:42:76: ab:05:fb:6b:84:49:b2:bc:bf:d2:d1:7e:d7:ab:3c:4a:69:ee: ac:ef:6a:aa:30:1a:84:f5:af:4f:ca:b9:0c:9e:d1:be:fa:1b: ed:38:f4:09:ae:a8:b3:0c:e4:9a:f4:5d:d7:b0:78:01:36:af: 14:2a:9c:04:84:e4:f2:bd:6d:42:23:a3:0e:5e:c6:4e:d1:17: 8f:67:b7:56:00:e8:38:32:12:28:69:c1:14:e8:68:03:0e:79: e7:25:47:22:70:8e:f8:ee:ef:78:e6:ce:dc:54:fa:ad:1c:a4: cd:27:e1:ff:56:29:31:a2:1e:1f:a9:09:c0:12:3f:56:26:af: e4:52:07:fb:29:4b:e2:1d:dc:61:e9:9f:ef:2f:c4:35:04:b6: b2:98:9d:da:4a:4e:39:83:d4:e6:a9:fd:eb:8d:d4:34:16:9d: 5f:cf:42:53:32:68:53:9c:72:4f:ac:87:df:eb:7c:f8:92:69: 57:b3:1b:fb:f6:b5:b5:3b:e3:c8:d0:3e:15:13:76:f6:91:81: fa:bd:fd:8e:99:d2 __________________________________________ [self_signed_pem] => Certificate: Data: Version: 3 (0x2) Serial Number: 0 (0x0) Signature Algorithm: sha256WithRSAEncryption Issuer: C=AT, ST=Vienna, L=Vienna, O=the lounge interactive design gmbh, OU=Administration, CN=www.test.rh Validity Not Before: Jul 24 09:44:41 2017 GMT Not After : Jul 22 09:44:41 2027 GMT Subject: C=AT, ST=Vienna, L=Vienna, O=the lounge interactive design gmbh, OU=Administration, CN=www.test.rh Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (3072 bit) Modulus: 00:9c:2c:b0:19:42:50:83:ed:c7:5c:d8:f7:c3:f7: 13:d5:17:a5:01:37:40:9a:e5:7f:43:88:22:35:89: 41:1b:b6:73:d7:f5:91:92:a9:54:b7:51:72:80:ef: 85:22:df:ac:bc:87:d3:85:f6:8a:72:35:2c:b6:16: 5b:d5:24:cb:4d:0f:b7:95:05:52:61:4f:bd:68:d0: 8e:8d:b4:86:e0:0c:02:03:63:e2:01:44:8a:d3:52: 24:c0:c1:07:a2:30:b2:29:9d:6c:c6:54:6b:aa:40: d5:ac:6f:2c:e0:ea:8d:31:4e:e1:01:4c:3d:b0:27: 07:1b:c5:39:01:a3:e6:ad:a5:c6:b4:76:8a:2d:ab: 5c:a5:11:97:8a:f1:81:cd:ba:41:5f:88:34:a0:09: d3:80:7c:32:b7:1c:74:1f:84:a3:40:2c:54:08:b7: b6:08:f5:ad:34:0e:88:bb:c0:68:3f:04:f4:8f:0a: 09:bb:e4:6d:24:18:24:5f:62:73:d6:7a:d0:a2:c4: d4:b2:02:3b:92:50:c4:3f:a4:28:2c:b9:54:0c:b1: da:2d:d3:9a:fb:88:23:9f:46:3b:7b:8d:f4:c5:8f: 3b:af:b6:e1:98:26:fd:31:b4:da:bd:4f:31:52:8c: 86:1f:20:88:0c:c1:6d:3f:dd:ed:66:51:9e:99:a9: aa:82:2c:0d:2f:b1:39:70:e7:b3:e3:cb:af:54:7f: 02:f0:9d:eb:34:d3:d5:94:fd:30:58:15:3a:4b:67: a2:0b:40:30:35:ee:b7:50:81:8e:6e:3a:bb:76:25: fa:66:ed:3d:d1:ad:ed:2f:24:b8:0e:e2:f8:04:99: a6:25:96:4b:a9:84:c1:71:c0:7d:b1:b7:bd:c8:3b: 78:25:41:f6:76:69:aa:4b:4c:be:37:b8:e2:1b:ed: fc:25:31:b6:0c:39:47:22:4e:8b:df:8d:7a:86:81: ae:df:c0:3b:0d:bc:23:30:b9:5b:2e:a1:b8:89:f4: a4:dc:90:b2:eb:58:51:86:d0:b5 Exponent: 65537 (0x10001) Signature Algorithm: sha256WithRSAEncryption 79:23:28:c4:4a:38:fb:e5:fd:b8:01:de:25:96:97:fe:ad:f7: 98:9e:ee:60:66:94:72:ff:13:2b:cc:96:b7:35:ff:1e:ea:a7: 60:39:4b:af:15:9a:0e:2d:14:46:ee:21:f8:17:e5:c5:0c:fe: ca:57:27:c6:40:c9:25:3d:71:70:36:ed:ec:36:e9:1d:40:6f: c6:81:ba:ef:ee:95:9f:0b:59:35:6d:96:44:54:80:e5:5c:63: 29:0d:83:6c:50:5f:80:01:ec:cd:16:76:bc:ee:9b:26:02:39: 9f:b8:f3:7e:01:d4:fe:e4:78:a6:27:4e:a5:54:7b:4d:9f:c5: 29:56:c5:70:df:6b:22:1d:bd:b9:9a:f5:b0:5f:9c:a1:72:79: a0:60:90:db:6c:13:88:48:1f:24:5e:1f:fb:9a:a7:3c:24:12: f1:a6:f5:a6:3b:78:47:bf:29:fc:25:22:59:21:f3:14:d2:6d: 65:8f:33:a2:0c:f6:c2:27:0e:5c:d5:ed:c8:1a:8f:d6:60:d0: 00:44:d5:9c:e0:30:e4:99:a1:d1:05:ff:af:bd:40:07:86:0e: 20:50:13:aa:9d:b2:7c:71:ee:4d:47:a0:56:3a:9c:f7:fe:64: 17:09:b4:45:de:85:34:30:b5:1b:bb:06:dd:ca:7f:8c:16:ea: c1:0b:34:32:1b:53:3b:60:94:85:3c:22:3f:fe:b7:5e:ea:86: 4b:97:76:0d:6a:7e:a5:be:3e:24:0b:91:6e:67:55:f2:c1:ed: 2f:b8:77:16:08:75:ee:9d:e0:62:4d:38:7c:16:e3:4b:c6:88: 08:62:49:3b:4b:c0:67:5e:e7:d3:11:99:c8:53:59:61:bc:23: 76:90:b4:15:8e:63:0d:e1:db:8c:14:54:dc:1e:21:17:46:16: 3a:81:f7:20:44:71:26:58:80:e6:1b:1a:66:0a:ab:2c:9a:d7: e8:9f:b3:4a:dd:14:9d:41:fc:d8:aa:82:e2:c9:3e:a1:63:8f: c1:64:00:98:6e:b3 ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=71050 -- Edit this bug report at https://bugs.php.net/bug.php?id=71050&edit=1