Facing issues with response from Fairplay SDK based service

Question

vijayvikram-kumar OP

Created 3w

Replies 4

Boosts 0

Views 1.1k

Participants 3

Currently we are building a service based on Fairplay SDK version 26.0. Currently our solution is using version 4.5.4.

When we run the below request to get version we get proper response

curl http://xx.xx.xx.xx:8080/fps/v Response - V26.0

Our client applications call below two APIs

https://GW_HOST:8080/fairplay_cert https://GW_HOST:8080/fairplay_license Within the cert API call, we are returning the fairplay public certificate. Currently we are trying to use the test certificate provided along with Fairplay SDK (test_fps_certificate_v26.bin)

Then within the fairplay_license API call, we are trying to reach fairplay service based on Fairplay SDK v26 We are seeing some issues with below request(attaching the request json payload)

curl -v -X POST
-H "Content-Type: application/json"
-d @SDKValidation_NewCert.json
http://xx.xx.xx.xx:8080/fps

SDKValidation_NewCert.json

We are getting below response from SDK

{"fairplay-streaming-response":{"create-ckc":[{"id":1,"status":-42605}]}} When we checked the apache error logs in the file "/etc/httpd/logs/error_log" we see below error

[DEBUG] ❌ Assertion failure: invalidCertificateErr (-42605) [src/extension.swift:249] This is looks to be some error related to certificate.

As mentioned earlier, client application is making a certificate call where we are returning the certificate set up .

These certificates are already configured in the credentials path.

Also note that the test samples provided with the SDK return valid license response.

We had earlier raised a similar ticket mentioned below and we were asked not to use test certs. So we have raise CSR and used new certs for testing.

https://developer.apple.com/forums/thread/836652?page=1

Answer 1

Security Engineer OP

Apple

2w

The error means that the SPC in the request was generated using certificate for which SDK either doesn't have corresponding private key or matching provisioning data.

Can you clarify how the SPC in the JSON above was created? Was it generated on a client using new certificate bundle?

In the SDK configuration file did you specify both private keys for RSA-1024 and RSA-2048 that match certificate bundle used by the client?

In the same configuration file did you specify provisioning data that was created on the development portal together with the certificate bundle used by the client.

Answer 2

vijayvikram-kumar OP

1w

After debugging further at our end, we noticed that there was an issue with cert deployment which was causing this certificate mismatch.

Even after this is fixed, license is not generated successfully.

We are noticing an exception this time.

Given the below contents of certificate.json file

{
    "certificates" : [
        {
            "certificate": "fps_certificate.bin",
            "1024-private-key": "priv_key_1024.pem",
            "2048-private-key": "priv_key_2048.pem",
            "provisioning-data": "provisioning_data.bin"
        }
    ]
}

we have below two queries

the two private key files mentioned here should be encrypted with passphrase or it should be in clear without any encoding?
Also when we generate csr, should we use encypted PEM or decrypted PEM.

Please same paylods and apache error logs

Sample payload - SampleJSONPayload.json

SampleJSONPayload.json

Apache error logs with encrypted PEM - Apache_Error_Log_encrypted_PEM.txt

Apache_Error_Log_encrypted_PEM.txt

Apache error logs with Decrypted PEM - Apache_Error_Log_Decrypted_PEM.txt

Apache_Error_Log_Decrypted_PEM.txt

If the answers to above queries are negative then we will have to raise a new csr.

Answer 3

vijayvikram-kumar OP

5d

Hi, Can you please help me resolve the questions added above?

We are totally blocked here

Answer 4

ColinMcKechney OP

5d

In response to your two questions:

Private key files should be in the clear without any encoding other than the standard PEM or DER
CSR should use a decrypted private key

Lookin at the error logs:

For the encrypted PEM it responds with a decoding error. This makes sense as the SDK doesn't make any attempt to decrypt a private key file before parsing so it's attempting to read a still-encrypted private key.

For the decrypted PEM the response is a permission denied error. This would most likely indicate an issue where the SDK doesn't have the correct permissions to read the PEM file at runtime. However, it's difficult to say exactly why the SDK / private key don't have the correct permissions without access to the runtime environment.