1

I want to add the Admission Extension to my Certificate. Therefor i use the Tool XCA, which uses OpenSSL to create the certificates.

This is my structre i wrote with some dummy Data:

1.3.36.8.3.3=ASN1:SEQUENCE:seq_sect

[seq_sect]
admissionAuthority=IMPLICIT:1,IA5STRING:MyGeneralName
contentsOfAdmissions=SEQUENCE:admissions_sect

[admissions_sect]
admissionAuthority=EXPLICIT:0,IMPLICIT:1,IA5STRING:MyGeneralNameAdmission
namingAuthority=EXPLICIT:1,SEQUENCE:namingAuthorithy_sect
professionInfos=SEQUENCE:professionInfo_sect

[professionInfo_sect]
namingAuthority=EXPLICIT:0,SEQUENCE:namingAuthorithy_sect
professionItems=UTF8String:String1,UTF8String:String2
professionOIDs=SEQUENCE:oid_sect
registrationNumber=PRINTABLESTRING:registrationNumber
addProfessionInfo=OCTETSTRING:ProffessionInfo

[oid_sect]
one=OID:1.2.3.4
two=OID:1.2.3.5

[namingAuthorithy_sect]
namingAuthorityId=OID:1.2.3.4
namingAuthorityUrl=IA5STRING:http://www.url.de
namingAuthorithyText=UTF8String:namingAuthorityTEXT

But it is not right. First Error i got ist here:

admissionAuthority=EXPLICIT:0, IMPLICIT:1,IA5STRING:MyGeneralNameAdmission

There the Tagging did not match. But don't know why. In the Definition of the Admission Syntax i have to tagg it EPLICIT but the GERNERALNAME must be tagged IMPLICIT, but i got an error. so where is the problem?

The next error is here:

professionItems=UTF8String:String1,UTF8String:String2

PROFESSIONITEM is a SEQUENCE of DIRECTORYSTRING, but when i read in the Certificate with BouncyCastle in Java i got DERUTF8STRING Exception, so here must a mistake by me, maybe i definied it false? hope anyone could help.

2
  • Do you have an example of a valid certificate? Jul 13, 2015 at 12:04
  • no :( if someone has one, it would be nice :)
    – Opa114
    Jul 13, 2015 at 13:31

1 Answer 1

0

You can see the generated structure using tools such as dumpasn1 or openssl asn1parse -i.


I tried creating an example structure using the schema and an actual ASN.1 compiler.

  • The admissionAuthority, I think, only needs to be configured for explicit tagging. (I don't have the slightest idea about tags though.

    admissionAuthority = EXPLICIT:1, IA5STRING:MyGeneralName
    

    Which seems to match the compiler output.

  • OpenSSL's "UTF8String:" extends until the end of the line. So what you have is one professionItem, with the value "String1,UTF8String:String2".

    Multiple values could be defined like this:

    professionItems.0 = UTF8String:String1
    professionItems.1 = UTF8String:String2
    

    But since they must be inside a SEQUENCE, you again need a separate section:

    professionItems = SEQUENCE:item_sect
    
    [item_sect]
    0 = UTF8String:String1
    1 = UTF8String:String2
    
  • But, professionItems needs to be a SEQUENCE of professionInfo SEQ's. For a SEQ of just one item, the simplest option is:

    professionItems = SEQWRAP, SEQUENCE:item_sect
    

    If you needed multiple items, you'd have to use another section:

    professionItems = SEQUENCE:prof_items_sect
    
    [prof_items_sect]
    0 = SEQUENCE:item0_sect
    1 = SEQUENCE:item1_sect
    ...
    

I successfully reproduced your example in comments with:

[seq_sect]
# GeneralName tag [4] is directoryName
#admissionAuthority = EXPLICIT:1, IA5STRING:[email protected]
#admissionAuthority = EXPLICIT:2, IA5STRING:example.com
admissionAuthority = EXPLICIT:4, SEQUENCE:authority_name_sect
#admissionAuthority = EXPLICIT:6, IA5STRING:https://www.example.com/
# this could be a "SEQWRAP, SEQUENCE:admission0_sect"
# as long as there's only one admission item
contentsOfAdmissions = SEQUENCE:admissions_sect

    [authority_name_sect]
    # this is a Name aka a RDNSequence...
    # each RelativeDistinguishedName generally only has one AttributeTypeAndValue
    # (multiple happen in LDAP but rarely), thus SETWRAP does the job here
    rdn.1 = SETWRAP, SEQUENCE:authority_dn_C_sect
    rdn.2 = SETWRAP, SEQUENCE:authority_dn_O_sect
    rdn.3 = SETWRAP, SEQUENCE:authority_dn_postal_sect

        [authority_dn_C_sect]
        oid = OID:2.5.4.6
        value = PRINTABLESTRING:DE

        [authority_dn_O_sect]
        oid = OID:2.5.4.10
        value = UTF8String:Firma A

        [authority_dn_postal_sect]
        oid = OID:2.5.4.16
        value = SEQUENCE:authority_dn_postal_values

            [authority_dn_postal_values]
            0 = UTF8String:Street
            1 = UTF8String:PostalCode Adress
            2 = UTF8String:DE

    [admissions_sect]
    admission.0 = SEQUENCE:admission0_sect

        [admission0_sect]
        professionInfos = SEQUENCE:professionInfos_sect

            [professionInfos_sect]
            professionInfo.0 = SEQUENCE:professionInfo0_sect

                [professionInfo0_sect]
                # namingAuthority = ...
                professionItems = SEQUENCE:professionItems_sect
                # professionOIDs = ...

                    [professionItems_sect]
                    professionItem.0 = UTF8String:Arzt/Ärztin
8
  • i tried it but same error when i parse it with BouncyCastle in Java. It has to to with the UTF8String in professionitems.
    – Opa114
    Jul 13, 2015 at 15:20
  • Alright, try converting the hex stuff into a binary file, and feed it to asn1parse or dumpasn1. Compare to your own certs. Jul 13, 2015 at 16:32
  • yes i know and i have done this, but i don't see the difference between this and my version above. did you see the difference?
    – Opa114
    Jul 13, 2015 at 18:02
  • Hmm, I'm having troubles even having dumpasn1 interpret it. But even from that, it seems to be equivalent to the result of admissionAuthority = EXPLICIT:4, SEQUENCE:name_sect with no additional fancy tagging. The explicit tag marks the GeneralName variant (a directoryName in this case), that's all. Jul 13, 2015 at 19:25
  • i will take a deeper look on it tomorrow and report. thanks!
    – Opa114
    Jul 13, 2015 at 19:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .