-
Notifications
You must be signed in to change notification settings - Fork 5.6k
Closed
Labels
Description
Description
x509.create_csr by default sets the version to 3, which is invalid for CSR (only 1 exists). Trying to import such a CSR with more strict libraries fails (latest versions of cryptography, whatever Go library Vault uses).
Setup
- on-prem machine
- VM (Virtualbox, KVM, etc. please specify)
- classic packaging
- onedir packaging
- used bootstrap to install
Steps to Reproduce the behavior
salt-call x509.create_private_key /tmp/pk
salt-call x509.create_csr /tmp/csr private_key=/tmp/pk>>> import cryptography
>>> cryptography.__version__
'38.0.3'
>>> a = """-----BEGIN CERTIFICATE REQUEST-----
... MIICVjCCAT4CAQIwADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM5+
... 0OS8+xIy2I475qlgxEqqSP28BncqlRG1d1VjB4Xc22K+QHS2ipeFM6NRlO2OytYy
... qMMgqU1lKU7sJXxw/uXfNMP40G3t5hrI8O/KtVbIYwujVkswgEMg4bZvmOSjyqte
... BbOH4baQK+7P8LN8Ceaja6d5QAWKBvKSD8f8X1khZP8Lw0rUJjOFWi+XIrEsyd8d
... gern7Qw6ATdFvLs7aY5p2AliUhp1zlqkBJqNcqpLQZubVlg8w1ABfzwFRvTslGio
... SCoCA0MJ0QyThgHjJIqpvZGVdrD4ZQP4rXZHMv8Qzquolpou0n984oCk8t3qyaR+
... WmJIdcPtmMYr8Y6YGKcCAwEAAaARMA8GCSqGSIb3DQEJDjECMAAwDQYJKoZIhvcN
... AQELBQADggEBAEwUc47pXGCNLmZSKAhDu4FbrVyW+PrdWGYKBI+onycy7wCqDP9c
... vQ4lGeuG3t074drgKvm9fIDUdTZLqDDXD2kOAW+7AYbRYxUvTxMiDyrsqyH+N590
... S+SucVJzEZTVNqrWLMn4JwOuXf4onuAxtFLOY+dSGbpU6CiFbaXk6qDDsankqn0Y
... TsAWx3PqeU2w9CT3a68rW214Avn1aMP+aCMHZ7QQpnTnRKXVZscOjiY6MT9Yb8Nv
... BldjvVnQN7bCjM2TQTMSbd00lD+071hLm6ceDQdoewbipNKyhBnQd4hFYJgDPQR7
... 1OVnGCilmno3MkKW4yztBX2gI2ifXSaunmY=
... -----END CERTIFICATE REQUEST-----"""
>>> from cryptography import x509
>>> x509.load_pem_x509_csr(a.encode())
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "/Users/jeanluc/.local/share/asdf/installs/python/3.10.4/lib/python3.10/site-packages/cryptography/x509/base.py", line 535, in load_pem_x509_csr
return rust_x509.load_pem_x509_csr(data)
cryptography.x509.base.InvalidVersion: 2 is not a valid CSR versionExpected behavior
Default to the correct version 1
Versions Report
salt --versions-report
(Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)Salt Version:
Salt: 3005.1
Dependency Versions:
cffi: Not Installed
cherrypy: Not Installed
dateutil: 2.8.1
docker-py: Not Installed
gitdb: Not Installed
gitpython: Not Installed
Jinja2: 3.0.3
libgit2: Not Installed
M2Crypto: 0.37.1
Mako: Not Installed
msgpack: 1.0.0
msgpack-pure: Not Installed
mysql-python: Not Installed
pycparser: Not Installed
pycrypto: Not Installed
pycryptodome: 3.9.7
pygit2: Not Installed
Python: 3.9.2 (default, Feb 28 2021, 17:03:44)
python-gnupg: Not Installed
PyYAML: 5.3.1
PyZMQ: 20.0.0
smmap: Not Installed
timelib: Not Installed
Tornado: 4.5.3
ZMQ: 4.3.4
System Versions:
dist: debian 11 bullseye
locale: utf-8
machine: x86_64
release: 5.10.0-18-amd64
system: Linux
version: Debian GNU/Linux 11 bullseye