Secure Authentication中的主题 SE05x certificate sign request with Sectigo

SE05x certificate sign request with Sectigo

wyss-11 — Wed, 11 Jan 2023 13:42:59 GMT

I'm trying to generate a valid CSR with the SE05x, but the CSR seems to have an invalid signature according to the online CRC checker https://redkestrel.co.uk/products/decoder/

Here's what I do:

sscli erase 0x1234
ssscli generate ecc 0x1234 NIST_P256
ssscli refpem ecc pair 0x1234 aci200.ref.key --format PEM
openssl req -new -key aci200.ref.key -out aci200.csr -config aci200.cnf

This is the result of the CSR check:

What could be the problem with my CSR file?
Could it be because I generated the CSR with the private key reference file?
The CSR file is attached (rename it to aci200.csr)

Thanks, Stefan

Re: SE05x certificate sign request with Sectigo

Kan_Li — Thu, 12 Jan 2023 08:19:44 GMT

Hi @wyss-11 ,

Have you enabled the openssl engine? This engine is used to decode the key references and invokes the SSS API with correct Key references for a cryptographic operation. Please kindly refer to the doc of "simw-top/doc/sss/plugin/openssl/scripts/readme.html" for more details.

Hope that helps,

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

Re: SE05x certificate sign request with Sectigo

wyss-11 — Thu, 12 Jan 2023 13:42:47 GMT

Thanks for the DOC pointer. Yes, I can successfully run the example scripts from the script folder. My OPENSSL_CONF is according to the readme.html.

So there seems to be another problem with the generated certificate in the example above?

Can you try to recreate my problem with your SE05x setup by entering my above listed commands and checking the resulting CSR with the online-tool link that I have provided?

Re: SE05x certificate sign request with Sectigo

wyss-11 — Thu, 12 Jan 2023 14:45:21 GMT

Well, out of nowhere, the invalid signature error disappeared when I re-generated the aci200.csr file. I don't know the reason for that, but my new aci200.csr is now accepted by the online CSR verification tool.

Thanks for your help!