unable to verify AWS EC2 Instance Identity Document with libressl

Question

I'm trying to follow the steps here:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html

to verify an instance identity document, and I'm getting success when I run on the instance (with OpenSSL 1.0.2k-fips 26 Jan 2017) and failure on my Macbook (with LibreSSL 2.2.7).

I've done a diff of the files and there's no difference. SHA1 included below.

Is there some obvious reason this would fail? Not really sure where to go from here.

On the instance:

[ec2-user@ip-10-215-73-128 ~]$ openssl smime -verify -in $PKCS7 -inform PEM -content $DOCUMENT -certfile AWSpubkey -noverify > /dev/null
Verification successful

[ec2-user@ip-10-215-73-128 ~]$ ls
AWSpubkey
[ec2-user@ip-10-215-73-128 ~]$ echo $DOCUMENT
/tmp/iid
[ec2-user@ip-10-215-73-128 ~]$ echo $PKCS7
/tmp/iid.pkcs7
[ec2-user@ip-10-215-73-128 ~]$ openssl version
OpenSSL 1.0.2k-fips  26 Jan 2017

[ec2-user@ip-10-215-73-128 ~]$ sha1sum $DOCUMENT
0ab2144f3a388f9ab211fcc61b79d9c3996aae13  /tmp/iid
[ec2-user@ip-10-215-73-128 ~]$ sha1sum $PKCS7
986e701e30828217a3289a79df2759beda5eacc2  /tmp/iid.pkcs7
[ec2-user@ip-10-215-73-128 ~]$ sha1sum AWSpubkey
58f35f20bd57ec01773c29d08ff813c6b6479837  AWSpubkey

Locally:

$ openssl smime -verify -in $PKCS7 -inform PEM -content $DOCUMENT -certfile AWSpubkey -noverify > /dev/null
Verification failure
140735950726088:error:21075076:PKCS7 routines:PKCS7_verify:content and data present:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-22.50.2/libressl/crypto/pkcs7/pk7_smime.c:297:

$ ls
AWSpubkey   iid.pkcs7   instance.iid
$ echo $DOCUMENT
instance.iid
$ echo $PKCS7
iid.pkcs7
$ openssl version
LibreSSL 2.2.7

$ sha1sum $DOCUMENT
0ab2144f3a388f9ab211fcc61b79d9c3996aae13  instance.iid
$ sha1sum $PKCS7
986e701e30828217a3289a79df2759beda5eacc2  iid.pkcs7
$ sha1sum AWSpubkey
58f35f20bd57ec01773c29d08ff813c6b6479837  AWSpubkey

Answer 1

I believe this is a problem that occurs due to different error handling in old LibreSSL/OpenSSL versions. (Think MacOS really should have used something a bit newer for their defaults)

In old versions an error is thrown when a non-detached PKCS7 signature is given together with input content (basically it assumed the data wouldn't be referenced in both the signature and an external file). Later versions defaulted to only throwing an error if called with a flag or skipping the check entirely depending on branch.

You can try to fix this by verifying with an updated version of LibreSSL or OpenSSL. You can get these on your mac through macports or homebrew.

Answer 2

It actually works locally if you just omit the -content $DOCUMENT part, and openssl will assume the content is included in the pkcs7 file already.