Problem with enrollment on cisco router #2100
Comments
|
Are you using an RSA intermediate CA? If you don't know, can you show the output of Can you try if you can get the contents of the request (the whole |
Hello, yes im using an RSA intermediate CA, here the output of the command : and here the full content error message : |
|
Got it: apparently the error is also returned when MD5 is used as the digest algorithm. This seems to be true for your request: It's a bit unfortunate that this error is returned in this case. It seems to be leftover from before we forked the repository at https://github.com/smallstep/pkcs7. I might fix that sometime soon. |
|
Thanks for the fast answer, my client is a old cisco router so i cant change the hashing and encryption algorithm, do you know when it can be patch. |
It's unlikely that we'll add support for MD5 in |
|
Thanks, I would like to try the option u mentioned, i never used go, im newbie in coding, im more in network part, do you have some tips on the part of the file i have to modify or things like that ? |
|
@Drig69 general guidelines for working You'll also need to check out https://github.com/smallstep/pkcs7, and set a replace in the replace github.com/smallstep/pkcs7 => /path/to/local/pkcs7The exact changes you need are a bit too much to spell out completely, but you'll have to start with adding support for After patching the |
|
I tried to do it with a git clone, and did what u said and when i tried to compile with make bootstrap && make i have the following error : |
|
@Drig69, try it without the Makefile, using |
|
Hello, I tried like we said and i have the following errors when Im trying to enroll certificate on my Router, INFO[0013] duration="341.178µs" duration-ns=341178 fields.time="2024-12-17T17:22:49+01:00" method=GET name=ca path="/scep/myscep/pkiclient.exe?operation=GetCACert&message=ubo" protocol=HTTP/1.0 referer= remote-address=10.0.0.2 request-id=c1b81304-2598-448c-886b-3f5b4890cc3d size=1072 status=200 user-agent="Mozilla/4.0 (compatible; MSIE 5.0; Cisco PKI)" user-id= I modified the pkcs7.go like this and set the replace to link it : import ( ) // PKCS7 Represents a PKCS7 structure type contentInfo struct { // ErrUnsupportedContentType is returned when a PKCS7 content type is not supported. type unsignedData []byte var ( ) func getHashForOID(oid asn1.ObjectIdentifier) (crypto.Hash, error) { // getDigestOIDForSignatureAlgorithm takes an x509.SignatureAlgorithm } // getOIDForEncryptionAlgorithm takes the public or private key type of the signer and } // Parse decodes a DER encoded PKCS7 package } func parseEnvelopedData(data []byte) (*PKCS7, error) { func parseEncryptedData(data []byte) (*PKCS7, error) { // SetFallbackLegacyX509CertificateParserEnabled enables parsing certificates var legacyX509CertificateParser struct { func isLegacyX509ParserEnabled() bool { func (raw rawCertificates) Parse() ([]*x509.Certificate, error) { } func isCertMatchForIssuerAndSerial(cert *x509.Certificate, ias issuerAndSerial) bool { // Attribute represents a key value pair attribute. Value must be marshalable byte type attributes struct { // Add adds the attribute, maintaining insertion order type sortableAttribute struct { type attributeSet []sortableAttribute func (sa attributeSet) Len() int { func (sa attributeSet) Less(i, j int) bool { func (sa attributeSet) Swap(i, j int) { func (sa attributeSet) Attributes() []attribute { func (attrs *attributes) ForMarshalling() ([]attribute, error) { Thanks by advance. |
I tried to make a lab with an IpSec VPN between 2 Cisco 2800 routers (old, with only SHA1 hash) with a scep auto enrollment. I have to use an Ubuntu server for the CA so i decided to use smallstep CA to provide a scep server. I've managed to get the CA certificate with the Cisco command 'crypto pki authenticate trustpoint_name' but when i tried to enroll the trustpoint, it failed with this message on the CA console :
ERRO[0136] duration="891.927µs" duration-ns=891927 error="scep get request failed: failed parsing SCEP request: pkcs7: cannot decrypt data: only RSA, DES, DES-EDE3, AES-256-CBC and AES-128-GCM supported" fields.time="2024-12-10T17:15:46+01:00" method=GET name=ca path="/scep/myscep/pkiclient.exe?operation=PKIOperation&message=MIIJIQYJKoZIhvcNAQcCoIIJEjCCCQ4CAQExDjAMBggqhkiG9w0CBQUAMIIEUQYJ%0AKoZIhvcNAQcBoIIEQgSCBD4wggQ6BgkqhkiG9w0BBw.............D%0A" protocol=HTTP/1.0 referer= remote-address=10.0.0.1 request-id=a619b201-9f6f-421b-a2a4-bc4387dfa81d size=145 status=500 user-agent= user-id=
I tried with an sscep client on computer and it worked.
My cisco pki configuration :
crypto pki trustpoint ubo
enrollment url http://10.0.0.3:8080/scep/myscep
password 7 071F205F5D1E161713
subject-name CN=testubo
revocation-check none
My ca.json configuration :
{
"root": "/root/.step/certs/root_ca.crt",
"federatedRoots": null,
"crt": "/root/.step/certs/intermediate_ca.crt",
"key": "/root/.step/secrets/intermediate_ca_key",
"address": "127.0.0.1:2016",
"insecureAddress": ":8080",
"dnsNames": [
"127.0.0.1"
],
"logger": {
"format": "text"
},
"db": {
"type": "badgerv2",
"dataSource": "/root/.step/db",
"badgerFileLoadingMode": ""
},
"authority": {
"provisioners": [
{
"type": "JWK",
"name": "hadri",
"key": {
"use": "sig",
"kty": "EC",
"kid": "ZKDSXDysfztANIZueMO_096snANaOuEUtWl9cgai5fE",
"crv": "P-256",
"alg": "ES256",
"x": "tn9PZeoUKL2vXKwFLXWd8LZch77-zOMrm93nQJFTlCg",
"y": "T0PH8G9lyD8oWtK18bsPuZmPiPjQY87dSUH7i8rvJcg"
},
"encryptedKey": "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoiaUFfZWkwVGlydmxOaTM3OXBCMlJKdyJ9.lsY8nFtzYh307PTpGs5C5pwhPGcDg1ZxVFz55ARZ3XkkHZ7pR-QpJw.9G2TSpkmvOCtr9a6.ra_JlginsSciJ6DDvCGS-uF74jWsKGXV5qGoXocVI7Ky9aqrX0_WI0cz2X7aBZt0Fvj6Wv_hfzyKjPPC3vgONx_2dZENWpoP0dGUyHyajzSILQGVnGINtLVnFFFv-REAgN0eCTqt1QyFUCULVbT3v59h1g2phGYf59iVOBeCmVGmU9wHW_BRvKHUA6xOA8uH2HqCKYyriFFs3rq0GieN-4zKXmYKWsEoLK5Dw7KfuYDFSP8HIcrnfnhmopk-MsLLzpTHuyT_GZ2tSlqG-5C0pgbahKqzfVNOXc3Avmpjk6vStfM8hSo_skJUtFWWzVlQVUaWD-OboRsy4_EIj8E.AkgSCuulaRt9-myVvr5kVg"
},
{
"type": "SCEP",
"name": "myscep",
"minimumPublicKeyLength": 1024,
"encryptionAlgorithmIdentifier": 2,
"challenge":"pipi",
"forceCN": true,
"options": {
"x509": {},
"ssh": {}
},
"claims": {
"enableSSHCA": true,
"disableRenewal": false,
"allowRenewalAfterExpiry": false,
"disableSmallstepExtensions": false
}
}
],
"template": {},
"backdate": "1m0s"
},
"tls": {
"cipherSuites": [
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
],
"minVersion": 1.2,
"maxVersion": 1.3,
"renegotiation": false
},
"commonName": "Step Online CA"
}
The error from the router :
Dec 10 17:16:26.619: CRYPTO_PKI: unlocked trustpoint ubo, refcount is e
Dec 10 17:16:26.623: CRYPTO_PKI: locked trustpoint ubo, refcount is 1
Dec 10 17:16:26.627: CRYPTO_PKI: unlocked trustpoint ubo , refcount is
Dec 10 17:16:26.627: CRYPTO_PKI: received msg of 367 bytes
Dec 10 17:16:26.627: CRYPTO PKI: HTTP header:
HTTP/1.0 500 Internal Server Error
Content-Type: text/plain; charset=utf-8
X-Content-Type-Options: nosniff
X-Request-Id: a619b201-9f6f-421b-a2a4-bc4387dfa81d
Date: Tue, 10 Dec 2024 16:15:46 GMT
Content-Length: 145
Dec 10 17:16:26.627: CRYPTO PKI: Received pki message (PKCS7) for trustpoint ubo: 145 bytes
73 63 65 70 20 67 65 74 20 72 65 71 75 65 73 74
20 66 61 69 60 65 64 3A 20 66 61 69 60 65 64 20
70 61 72 73
75 65 73 74
69 68 67 20 53 43 45 50 20 72 65 71
3A 20 70 68 63 73 37 3A 28 63 61 6E
6E 6F 74 20 64 65 63 72 79 70 74 20 64 61 74 61
3A 20 6F 6E 6C 79 20 52 53 41 20 20 44 45 53 20
20 44 45 53 20 45 44 45 33 20 20 41 45 53 20 32
35 36 20 43 42 43 20 61 6E 64 20 41 45 53 2D 31
32 38 20 47 43 40 20 73 75 70 70 6F 72 74 65.64
BA
Dec 10 17:16:26.631: CRYPTO PKI: make trustedCerts list for ubo
Dec 10 17:16:26.631: CRYPTO_PKI: subject="cn=intermediate CA" serial number 51 DA IF 95 EA 29 C5 C8 A8 49 24 35 60 OF 20 FE
Dec 18 17:16:26.635: E/cert-c/source/p7contnt.c(167): Error #703h
Dec 10 17:16:26.635: pkcs7 verify data returned status 0x703
Dec 10 17:16:26.635: CRYPTO PKI: status 1795: failed to verify
Dec 10 17:16:26.635: CRYPTO PKI: status 1795: failed to process the inner content
Dec 10 17:16:26.635: %PKI-6-CERTFAIL: Certificate enrollment failed.
Dec 10 17:16:26:635: CRYPTO_PKI: All enrollment requests completed for trustpoint ubo.
Dec 18 17:16:26.635: CRYPTO PKI: All enrollment requests completed for trustpoint ubo.
Dec 10 17:16:26.635: CRYPTO PKI: All enrollment requests completed for trustpoint ubo.
Dec 10 17:16:26.639: CRYPTO_PKI: All enrollment requests completed for trustpoint ubo.
Thanks by advance.
The text was updated successfully, but these errors were encountered: