0

I'm trying to follow the steps here:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html

to verify an instance identity document, and I'm getting success when I run on the instance (with OpenSSL 1.0.2k-fips 26 Jan 2017) and failure on my Macbook (with LibreSSL 2.2.7).

I've done a diff of the files and there's no difference. SHA1 included below.

Is there some obvious reason this would fail? Not really sure where to go from here.

On the instance:

[ec2-user@ip-10-215-73-128 ~]$ openssl smime -verify -in $PKCS7 -inform PEM -content $DOCUMENT -certfile AWSpubkey -noverify > /dev/null
Verification successful

[ec2-user@ip-10-215-73-128 ~]$ ls
AWSpubkey
[ec2-user@ip-10-215-73-128 ~]$ echo $DOCUMENT
/tmp/iid
[ec2-user@ip-10-215-73-128 ~]$ echo $PKCS7
/tmp/iid.pkcs7
[ec2-user@ip-10-215-73-128 ~]$ openssl version
OpenSSL 1.0.2k-fips  26 Jan 2017

[ec2-user@ip-10-215-73-128 ~]$ sha1sum $DOCUMENT
0ab2144f3a388f9ab211fcc61b79d9c3996aae13  /tmp/iid
[ec2-user@ip-10-215-73-128 ~]$ sha1sum $PKCS7
986e701e30828217a3289a79df2759beda5eacc2  /tmp/iid.pkcs7
[ec2-user@ip-10-215-73-128 ~]$ sha1sum AWSpubkey
58f35f20bd57ec01773c29d08ff813c6b6479837  AWSpubkey

Locally:

$ openssl smime -verify -in $PKCS7 -inform PEM -content $DOCUMENT -certfile AWSpubkey -noverify > /dev/null
Verification failure
140735950726088:error:21075076:PKCS7 routines:PKCS7_verify:content and data present:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-22.50.2/libressl/crypto/pkcs7/pk7_smime.c:297:

$ ls
AWSpubkey   iid.pkcs7   instance.iid
$ echo $DOCUMENT
instance.iid
$ echo $PKCS7
iid.pkcs7
$ openssl version
LibreSSL 2.2.7

$ sha1sum $DOCUMENT
0ab2144f3a388f9ab211fcc61b79d9c3996aae13  instance.iid
$ sha1sum $PKCS7
986e701e30828217a3289a79df2759beda5eacc2  iid.pkcs7
$ sha1sum AWSpubkey
58f35f20bd57ec01773c29d08ff813c6b6479837  AWSpubkey
1

I believe this is a problem that occurs due to different error handling in old LibreSSL/OpenSSL versions. (Think MacOS really should have used something a bit newer for their defaults)

In old versions an error is thrown when a non-detached PKCS7 signature is given together with input content (basically it assumed the data wouldn't be referenced in both the signature and an external file). Later versions defaulted to only throwing an error if called with a flag or skipping the check entirely depending on branch.

You can try to fix this by verifying with an updated version of LibreSSL or OpenSSL. You can get these on your mac through macports or homebrew.

  • 1
    Thanks AlphaD, that was the pointer I needed. Added a link to brew-installed openssl 1.0.2 in /usr/local/bin and all is right with that part of the world now. :) – Scott Nov 29 '18 at 18:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.