What is "-srvcert" in OpenSSL cmp command line?

Question

I use the following command to get a signed certificate from PKI.

What is the content of the file srvcert.crt of the option -srvcert ? It seems the srvcert.crt file is not the public certificate of the pki_server. Indeed, I tried with it and it does not work.

openssl cmp -cmd ir -server pki_server:8040 \
-path signing-cmp/test -cert /tmp/mycert.crt \
-key /tmp/mycert.key -newkey /tmp/new.key \
-subject '/C=FR/CN=domain.com/ST=London/L=London/O=Organization/OU=IT Administration' \
-certout /tmp/new.crt -srvcert /tmp/srvcert.crt

Here is how got the public certificate of the PKI. The option -srvcert does not work with this file.

echo -n | openssl s_client -showcerts -connect pki_server:443 \
    2>/dev/null  | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /tmp/srvcert.crt

Answer 1

I am citing from man openssl-cmp

Server authentication options

...
-srvcert filename
The specific CMP server certificate to use and directly trust (even if it is expired) when verifying signature-based protection of CMP response messages. May be set alternatively to the -trusted option if the certificate is available and only this one shall be accepted.

So this option is used to authenticate the server but is not required.

The example for enrollment in this man page does have a shared secret between server and client but does not use -srvcert at all.

openssl cmp -cmd ir -server 127.0.0.1:8080 -path pkix/ \
   -ref 1234 -secret pass:1234-5678-1234-5678 \
   -recipient "/CN=CMPserver" \
   -newkey cl_key.pem -subject "/CN=MyName" \
   -cacertsout capubs.pem -certout cl_cert.pem

My suggestion for now would be to omit server authentication and test if everything else works.