Load Cert+Key into Ararat Synapse OpenSSL from string?
lazarus / 38-Networking and Web Programming

----------------------------------------------------------------------
PizzaProgram · 2022-05-08 14:13

Hi,
 What if I have the Private Key and Public Certificate as "string"
(and not as File) ?
How do I load it?
For example:
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i uses
httpsend, ssl_openssl;constc_CER: AnsiString = '-----BEGIN
CERTIFICATE-----'#10+'MIIG4DC ... '...var    HTTP: THTTPSend;begin   
HTTP := THTTPSend.Create;    HTTP.Sock.SSL.Certificate := c_CER;   
HTTP.Sock.SSL.PrivateKey  := c_priv_key;    HTTP.Sock.SSl.VerifyCert
 := True; 
This is not working. Http error code 500 .
I guess I have to "digest" the Base64 code into raw bytes.
But How ?

----------------------------------------------------------------------
PizzaProgram · 2022-05-08 15:21

With this technique:
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i
TSSLOpenSSL(HTTP.Sock.SSL).LastErrorDesc
I am able to get a proper error msg:
Code: [Select]error:068000A8:asn1 encoding routines::wrong tag

----------------------------------------------------------------------
zeljko · 2022-05-08 16:58

Quote from: PizzaProgram on May 08, 2022, 04:13:19 pmHi,
 What if I have the Private Key and Public Certificate as "string"
(and not as File) ?
How do I load it?
For example:
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i uses
httpsend, ssl_openssl;constc_CER: AnsiString = '-----BEGIN
CERTIFICATE-----'#10+'MIIG4DC ... '...var    HTTP: THTTPSend;begin   
HTTP := THTTPSend.Create;    HTTP.Sock.SSL.Certificate := c_CER;   
HTTP.Sock.SSL.PrivateKey  := c_priv_key;    HTTP.Sock.SSl.VerifyCert
 := True; 
This is not working. Http error code 500 .
I guess I have to "digest" the Base64 code into raw bytes.
But How ?

Probably it expects filename instead of certificate data ?

----------------------------------------------------------------------
PierceNg · 2022-05-09 03:08

Quote from: PizzaProgram on May 08, 2022, 04:13:19 pmHi,
 What if I have the Private Key and Public Certificate as "string"
(and not as File) ?

Why not just save the data you have as files?

An X.509 public key certificate has an expiry date. When one expires,
you may get a replacement certificate for the same private key, or you
may get a certificate for a new private key. If you embed key and cert
in your source code, then you'll have to rebuild your program when the
time comes. If the data is kept in files outside your executable
program, you just replace the files. Remember to secure the private
key using operating system file permissions at least.

----------------------------------------------------------------------
PizzaProgram · 2022-05-09 17:34

Quote from: PierceNg on May 09, 2022, 05:08:40 amWhy not just save the
data you have as files?

Because of 2 reasons:
 - the cert + key strings are stored in a database, distributing it to
every client PC
 - revealing it by saving it to a file on every PC is very unsecure!
Anybody could simply copy them to a PenDrive.

It would be better, if it would work, as it should and I could feed
the string directly.
I'm starting to think, it's a bug?

----------------------------------------------------------------------
Thausand · 2022-05-09 18:09

Certificate is not file but string (http://synapse.ararat.cz/doc/help/
blcksock.TCustomSSL.html#Certificate)
QuoteUsed for loading certificate from binary string. See to plugin
documentation if this method is supported and how!
For file there is special certificatefile property.

I not know how string is expect to be encoded.

Here (http://synapse.ararat.cz/doc/help/ssl_openssl.html) it write:
QuoteTCustomSSL.Certificate for ASN1 DER format only.

String must be binary string, maybe remove begin/end certificate text
?

----------------------------------------------------------------------
rvk · 2022-05-09 18:28

Yes the string needs to be ASN1 DER.
The file can be both PEM and ASN1 DER.
See ssl_openssl.pas
QuoteFor handling keys and certificates you can use this properties:
@link(TCustomSSL.CertificateFile) for PEM or ASN1 DER (cer) format.
@br
@link(TCustomSSL.Certificate) for ASN1 DER format only. @br
@link(TCustomSSL.PrivateKeyFile) for PEM or ASN1 DER (key) format. @br
@link(TCustomSSL.PrivateKey) for ASN1 DER format only. @br
@link(TCustomSSL.CertCAFile) for PEM CA certificate bundle. @br
@link(TCustomSSL.PFXFile) for PFX format. @br
@link(TCustomSSL.PFX) for PFX format from binary string. @br
You can probably look in the source how to convert it in code.

For testing you can also do it manually and take the result from file.
openssl x509 -inform PEM -outform DER -in server.pem -out server.der

----------------------------------------------------------------------
PizzaProgram · 2022-05-12 19:16

This is a Test-code only (made by someone else).
 It's very ugly, but:

IT WORKS :-)

Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i const CRLF
= #13+#10;var List : TStringList; List :=
TStringList.Create(); List.LoadFromFile(cerfile);List.Text :=
AnsiReplaceStr(List.Text, CRLF, '');List.Text :=
AnsiReplaceStr(List.Text, '-----BEGIN CERTIFICATE-----', '');List.Text
:= AnsiReplaceStr(List.Text, '-----END CERTIFICATE-----',
'');HTTP.Sock.SSL.Certificate :=
DecodeStringBase64(List.Text);HTTP.Headers.Add('x-certificate: ' +
List.Text); List.LoadFromFile(keyfile);List.Text :=
AnsiReplaceStr(List.Text, CRLF, '');List.Text :=
AnsiReplaceStr(List.Text, '-----BEGIN PRIVATE KEY-----', '');List.Text
:= AnsiReplaceStr(List.Text, '-----END PRIVATE KEY-----',
'');HTTP.Sock.SSL.PrivateKey :=
DecodeStringBase64(List.Text);HTTP.Headers.Add('x-jws-signature: ' +
List.Text); List.Free;

----------------------------------------------------------------------
zamronypj · 2022-05-12 19:58

Quote from: PizzaProgram on May 12, 2022, 09:16:03 pmThis is a Test-
code only (made by someone else).
 It's very ugly, but:

IT WORKS :-)

Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i const CRLF
= #13+#10;var List : TStringList; List :=
TStringList.Create(); List.LoadFromFile(cerfile);List.Text :=
AnsiReplaceStr(List.Text, CRLF, '');List.Text :=
AnsiReplaceStr(List.Text, '-----BEGIN CERTIFICATE-----', '');List.Text
:= AnsiReplaceStr(List.Text, '-----END CERTIFICATE-----',
'');HTTP.Sock.SSL.Certificate :=
DecodeStringBase64(List.Text);HTTP.Headers.Add('x-certificate: ' +
List.Text); List.LoadFromFile(keyfile);List.Text :=
AnsiReplaceStr(List.Text, CRLF, '');List.Text :=
AnsiReplaceStr(List.Text, '-----BEGIN PRIVATE KEY-----', '');List.Text
:= AnsiReplaceStr(List.Text, '-----END PRIVATE KEY-----',
'');HTTP.Sock.SSL.PrivateKey :=
DecodeStringBase64(List.Text);HTTP.Headers.Add('x-jws-signature: ' +
List.Text); List.Free;      
What you are doing is very dangerous as you expose your private key in
HTTP header. Private key need to be kept secret

----------------------------------------------------------------------
PizzaProgram · 2022-05-13 08:01

This is a MUST, demanded by our government: 
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i
HTTP.Headers.Add('x-certificate: ' + List.Text);
But you are right about the 2th one:
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i
List.LoadFromFile(keyfile);...HTTP.Headers.Add('x-jws-signature: ' +
List.Text);That is a BIG mistake! Mixing JOSE JWS signature with
Private key and revealing it... 
I will tell the guy to delete it.

There is also a finished function that is doing all this in one line:
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i uses pfpem,
basenenc, ...  ... := basenenc.Base64URL.Decode(fppem.PemToDER(
private_Key_string , _BEGIN_PRIVATE_KEY, _END_PRIVATE_KEY ));
But that is generating TByte value and I don't know how to convert
TByte back to String...

----------------------------------------------------------------------
PizzaProgram · 2022-05-13 10:18

OK, here is the final, tested, short solution: 

Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i uses
basenenc, fppem, ...   HTTP.Sock.SSL.PrivateKey  :=
basenenc.GetRawStringFromBytes(fppem.PemToDER( priv_key_string ,
_BEGIN_PRIVATE_KEY, _END_PRIVATE_KEY ));  HTTP.Sock.SSL.Certificate :=
basenenc.GetRawStringFromBytes(fppem.PemToDER( cert_string     ,
_BEGIN_PRIVATE_KEY, _END_PRIVATE_KEY ));