From siddjain@live.com Wed Apr 24 16:26:51 2019 From: siddjain@live.com To: openldap-bugs@openldap.org Subject: Re: (ITS#9014) OpenLDAP modifies user provided TLS certificate before sending it to client Date: Wed, 24 Apr 2019 16:26:49 +0000 Message-ID: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============6013370356599914543==" --===============6013370356599914543== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit --_000_MWHPR08MB24001BB2C0F56927A628AF69B53C0MWHPR08MB2400namp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable we have documented complete steps to repro the bug here with container logs. ________________________________ From: Howard Chu Sent: Monday, April 22, 2019 10:15 AM To: siddjain(a)live.com; openldap-its(a)OpenLDAP.org Subject: Re: (ITS#9014) OpenLDAP modifies user provided TLS certificate bef= ore sending it to client siddjain(a)live.com wrote: > Full_Name: SIDDHARTH JAIN > Version: 2.4.45 > OS: Linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (173.226.196.10) > > > In some cases, OpenLDAP will modify the TLS certificate given to it befor= e > sending it over to the client resulting in a certificate signature error.= An > example of certificate it modifies is given below: OpenLDAP never touches the certificates you configure. If you're getting a = corrupted certificate then there's either a bug in your storage/filesystem or in your= SSL/TLS library. -- -- Howard Chu CTO, Symas Corp. https://eur04.safelinks.protection.outlook.com= /?url=3Dhttp%3A%2F%2Fwww.symas.com&data=3D02%7C01%7C%7Cb0dec02e090a48ff= 954b08d6c7462da0%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C6369155015543= 63548&sdata=3D7ca82woC2PGsf9x0qYDT1izZ5MSqJbxA4T9m8kq5y2Y%3D&reserv= ed=3D0 Director, Highland Sun https://eur04.safelinks.protection.outlook.com= /?url=3Dhttp%3A%2F%2Fhighlandsun.com%2Fhyc%2F&data=3D02%7C01%7C%7Cb0dec= 02e090a48ff954b08d6c7462da0%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C63= 6915501554363548&sdata=3DFr3v%2FI3WSXtWqXOFDY%2F9Z4%2FqS%2F%2FvC4YMJQDR= GNjx8Lo%3D&reserved=3D0 Chief Architect, OpenLDAP https://eur04.safelinks.protection.outlook.com= /?url=3Dhttp%3A%2F%2Fwww.openldap.org%2Fproject%2F&data=3D02%7C01%7C%7C= b0dec02e090a48ff954b08d6c7462da0%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0= %7C636915501554373561&sdata=3DJ%2B926RRaeQIx6%2BIvx70BnHqZ0zj4SO5ilR6VP= vdiTsk%3D&reserved=3D0 --_000_MWHPR08MB24001BB2C0F56927A628AF69B53C0MWHPR08MB2400namp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

we have documented complete steps to repro the bug <= a href=3D"https://github.com/siddjain/openldap-bug" style=3D"box-sizing: bo= rder-box; background-color: rgb(255, 255, 255); color: rgb(3, 102, 214); fo= nt-family: -apple-system, system-ui, "Segoe UI", Helvetica, Arial= , sans-serif, "Apple Color Emoji", "Segoe UI Emoji", &q= uot;Segoe UI Symbol"; font-size: 14px">here wit= h container logs.

From: Howard Chu <hyc(a)sy= mas.com>
Sent: Monday, April 22, 2019 10:15 AM
To: siddjain(a)live.com; openldap-its(a)OpenLDAP.org
Subject: Re: (ITS#9014) OpenLDAP modifies user provided TLS certific= ate before sending it to client

siddjain(a)live.com wrote:
> Full_Name: SIDDHARTH JAIN
> Version: 2.4.45
> OS: Linux
> URL: ftp://ftp.openldap.o= rg/incoming/
> Submission from: (NULL) (173.226.196.10)
>
>
> In some cases, OpenLDAP will modify the TLS certificate given to it be= fore
> sending it over to the client resulting in a certificate signature err= or. An
> example of certificate it modifies is given below:

OpenLDAP never touches the certificates you configure. If you're getting a = corrupted
certificate then there's either a bug in your storage/filesystem or in your= SSL/TLS library.

--
-- Howard Chu
CTO, Symas Corp. &nbs= p; https://eur04.safelinks.protection.outlook.com/?url=3Dhttp%3A%2F%2Fwww.syma= s.com&data=3D02%7C01%7C%7Cb0dec02e090a48ff954b08d6c7462da0%7C84df9e= 7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636915501554363548&sdata=3D7ca= 82woC2PGsf9x0qYDT1izZ5MSqJbxA4T9m8kq5y2Y%3D&reserved=3D0
Director, Highland Sun https://eur04.safelinks.protection.outlook.com/?url=3Dhttp%3A%2F%2Fhighland= sun.com%2Fhyc%2F&data=3D02%7C01%7C%7Cb0dec02e090a48ff954b08d6c7462d= a0%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636915501554363548&= sdata=3DFr3v%2FI3WSXtWqXOFDY%2F9Z4%2FqS%2F%2FvC4YMJQDRGNjx8Lo%3D&re= served=3D0
Chief Architect, OpenLDAP https://eur04.safelinks.protection.outlook.com/?url=3Dhttp%3A%2F%2Fwww.open= ldap.org%2Fproject%2F&data=3D02%7C01%7C%7Cb0dec02e090a48ff954b08d6c= 7462da0%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636915501554373561&= ;amp;sdata=3DJ%2B926RRaeQIx6%2BIvx70BnHqZ0zj4SO5ilR6VPvdiTsk%3D&res= erved=3D0

--_000_MWHPR08MB24001BB2C0F56927A628AF69B53C0MWHPR08MB2400namp_-- --===============6013370356599914543==--