From 586040a0ad57bb8e862399a774683d77d6194475 Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Mon, 20 Oct 2025 14:58:00 +0200 Subject: [PATCH] zkey/ekmfweb: Validate the certificate during client registration MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When registering a zkey client at the EKMFWeb server, validate the certificate if it's public key matches with the identity key of the zkey client. Only allow registration when the certificate matches. This helps to prevent users from erroneously registering a wrong or outdated certificate for a zkey client. Signed-off-by: Ingo Franzki Reviewed-by: Finn Callies Signed-off-by: Jan Höppner --- zkey/ekmfweb/zkey-ekmfweb.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/zkey/ekmfweb/zkey-ekmfweb.c b/zkey/ekmfweb/zkey-ekmfweb.c index 8a939db9..6fa3a5dd 100644 --- a/zkey/ekmfweb/zkey-ekmfweb.c +++ b/zkey/ekmfweb/zkey-ekmfweb.c @@ -2819,6 +2819,7 @@ out: static int _load_certificate(struct plugin_handle *ph, const char *cert_file, unsigned char **cert, size_t *cert_size) { + X509 *x509_cert = NULL; size_t count, size; unsigned char *buf; struct stat sb; @@ -2850,6 +2851,28 @@ static int _load_certificate(struct plugin_handle *ph, const char *cert_file, goto out; } + rewind(fp); + x509_cert = PEM_read_X509(fp, NULL, NULL, NULL); + if (x509_cert == NULL) { + rc = -EIO; + _set_error(ph, + "Failed to decode certificate from file '%s': %s", + cert_file, strerror(-rc)); + goto out; + } + + rc = _select_cca_adapter(ph); + if (rc != 0) + goto out; + + rc = ekmf_validate_cert(&ph->ekmf_config, x509_cert, + &ph->ext_lib, ph->pd.verbose); + if (rc != 0) { + _set_error(ph, "The certificate from file '%s' does not match " + "with the identity key", cert_file); + goto out; + } + *cert_size = size; *cert = buf; @@ -2859,6 +2882,9 @@ out: free(buf); fclose(fp); + if (x509_cert != NULL) + X509_free(x509_cert); + return rc; }