From f267c3ad749f3f4f048fdc38898cb9e21133546a Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Tue, 8 Feb 2022 08:12:33 -0500 Subject: [PATCH] Use application/pem-certificate-chain for PEMs (#13927) * Use application/pem-certificate-chain for PEMs As mentioned in #10948, it appears we're incorrectly using the `application/pkix-cert` media type for PEM blobs, when `application/x-pem-file` is more appropriate. Per RFC 5280 Section 4.2.1.13, `application/pkix-crl` is only appropriate when the CRL is in DER form. Likewise, Section 4.2.2.1 states that `application/pkix-cert` is only applicable when a single DER certificate is used. Per recommendation in RFC 8555 ("ACME"), Section 7.4.2 and 9.1, we use the newer `application/pem-certificate-chain` media type for certificates. However, this is not applicable for CRLs, so we use fall back to `application/x-pem-file` for these. Notably, no official IETF source is present for the latter. On the OpenSSL PKI tutorial (https://pki-tutorial.readthedocs.io/en/latest/mime.html), this type is cited as coming from S/MIME's predecessor, PEM, but neither of the main PEM RFCs (RFC 934, 1421, 1422, 1423, or 1424) mention this type. Signed-off-by: Alexander Scheel * Add changelog entry Signed-off-by: Alexander Scheel --- builtin/logical/pki/backend_test.go | 2 +- builtin/logical/pki/ca_test.go | 2 +- builtin/logical/pki/path_fetch.go | 3 +++ changelog/13927.txt | 3 +++ 4 files changed, 8 insertions(+), 2 deletions(-) create mode 100644 changelog/13927.txt diff --git a/builtin/logical/pki/backend_test.go b/builtin/logical/pki/backend_test.go index 5a159236cea5..1098b5409884 100644 --- a/builtin/logical/pki/backend_test.go +++ b/builtin/logical/pki/backend_test.go @@ -1768,7 +1768,7 @@ func TestBackend_PathFetchValidRaw(t *testing.T) { if bytes.Compare(resp.Data[logical.HTTPRawBody].([]byte), pemCert) != 0 { t.Fatalf("failed to get pem cert") } - if resp.Data[logical.HTTPContentType] != "application/pkix-cert" { + if resp.Data[logical.HTTPContentType] != "application/pem-certificate-chain" { t.Fatalf("failed to get raw cert content-type") } } diff --git a/builtin/logical/pki/ca_test.go b/builtin/logical/pki/ca_test.go index 5bbb524ed9e2..c1ba77cbde41 100644 --- a/builtin/logical/pki/ca_test.go +++ b/builtin/logical/pki/ca_test.go @@ -320,7 +320,7 @@ func runSteps(t *testing.T, rootB, intB *backend, client *api.Client, rootName, if diff := deep.Equal(resp.Data["http_raw_body"].([]byte), []byte(caCert)); diff != nil { t.Fatal(diff) } - if resp.Data["http_content_type"].(string) != "application/pkix-cert" { + if resp.Data["http_content_type"].(string) != "application/pem-certificate-chain" { t.Fatal("wrong content type") } } diff --git a/builtin/logical/pki/path_fetch.go b/builtin/logical/pki/path_fetch.go index 3636062f8c23..5740147c4584 100644 --- a/builtin/logical/pki/path_fetch.go +++ b/builtin/logical/pki/path_fetch.go @@ -157,6 +157,7 @@ func (b *backend) pathFetchRead(ctx context.Context, req *logical.Request, data contentType = "application/pkix-cert" if req.Path == "ca/pem" { pemType = "CERTIFICATE" + contentType = "application/pem-certificate-chain" } case req.Path == "ca_chain" || req.Path == "cert/ca_chain": serial = "ca_chain" @@ -168,6 +169,7 @@ func (b *backend) pathFetchRead(ctx context.Context, req *logical.Request, data contentType = "application/pkix-crl" if req.Path == "crl/pem" { pemType = "X509 CRL" + contentType = "application/x-pem-file" } case req.Path == "cert/crl": serial = "crl" @@ -177,6 +179,7 @@ func (b *backend) pathFetchRead(ctx context.Context, req *logical.Request, data contentType = "application/pkix-cert" if strings.HasSuffix(req.Path, "/pem") { pemType = "CERTIFICATE" + contentType = "application/pem-certificate-chain" } default: serial = data.Get("serial").(string) diff --git a/changelog/13927.txt b/changelog/13927.txt new file mode 100644 index 000000000000..ec0e99fd6971 --- /dev/null +++ b/changelog/13927.txt @@ -0,0 +1,3 @@ +```release-note:improvement +secrets/pki: Use application/pem-certificate-chain for PEM certificates, application/x-pem-file for PEM CRLs +```