Cert Chain Verification

Question

KaranMDT OP

Created Mar ’22

Replies 4

Boosts 0

Views 1.8k

Participants 2

Hello,

I am trying to run cert chain verification and running into a problem where my trust object is null.

SecTrustCreateWithCertificates(certificates, SecPolicyCreateBasicX509(), trustObject)

Where "certificates" is an array that contains 3 SecCertificate, first one is the leaf cert, second is the intermediate and last one is the root cert.

osStatus returned is -50 which translates to "One or more parameters passed to a function were not valid"

If the array only has the leaf cert, the trust object is created just fine but obviously the SecTrustEvaluateWithError returns false since I am not passing in the intermediate and root cert. Root cert is suppose to be the anchor cert so I tried setting it too but no luck. NOTE: I do not have these 3 certs saved in keychain or trust store, I create them using SecCertificateCreateWithData which I receive from the server. I have also verified from open ssl and the generated certs are valid.

Answered by DTS Engineer in 707111022

Can the trust object be created using self signed or non-public CA ?

Yes. I regularly do this for testing purposes.

In terms of wonky certificates, my experience is that, if an Apple system is grumpy about your cert, it’s the SecCertificateCreateWithData call that fails. I’ve never seen SecTrustCreateWithCertificates return nil. In my experience, if trust evaluation is going to fail, SecTrustCreateWithCertificates works and then any failures get reported via SecTrustEvaluate.

Hence my desire to get a copy of these certs so that I can see what’s going on.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Boost

Answer 1

DTS Engineer OP

Apple

Mar ’22

I am trying to run cert chain verification and running into a problem where my trust object is null.

Well, that’s weird.

Can you share the certificates in question with us? If so, please hex dump them (using xxd), save the results to a .txt file, and then post the file here as an attachment (click the paperclip icon and choose Add Text).

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 2

KaranMDT OP

Mar ’22

Hi Eskimo, Sorry, I can not provide these certs, but if there's any particular information in them that can be helpful to you to evaluate I can try to give you that.

For example:

Leaf cert has: ASN1 OID: prime256v1 NIST CURVE: P-256

X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Intermediate Cert has: ASN1 OID: prime256v1 NIST CURVE: P-256

X509v3 extensions: X509v3 Basic Constraints: critical CA:TRUE X509v3 Key Usage: critical Certificate Sign

And root cert has: ASN1 OID: prime256v1 NIST CURVE: P-256

X509v3 extensions: X509v3 Basic Constraints: critical CA:TRUE X509v3 Key Usage: critical Certificate Sign

0

Answer 3

DTS Engineer OP

Apple

Mar ’22

I can not provide these certs

Weird. Certificates don’t contain any secret material — a certificate is just a public key and some metadata, all signed by the issuer — so most folks are happy to share them [1].

It’s unlikely that I’ll be able to provide any useful analysis without seeing the actual certs involved. If you’re able to share them privately, open a DTS tech support incident and we can pick things up in that context.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] Note that a certificate is different from a digital identity, which includes the matching private key. See Certificate Signing Requests Explained for a discussion of this ongoing terminological train wreck.

0

Answer 4

DTS Engineer OP

Apple

Mar ’22

Accepted Answer

Can the trust object be created using self signed or non-public CA ?

Yes. I regularly do this for testing purposes.

In terms of wonky certificates, my experience is that, if an Apple system is grumpy about your cert, it’s the SecCertificateCreateWithData call that fails. I’ve never seen SecTrustCreateWithCertificates return nil. In my experience, if trust evaluation is going to fail, SecTrustCreateWithCertificates works and then any failures get reported via SecTrustEvaluate.

Hence my desire to get a copy of these certs so that I can see what’s going on.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0