Upload whole certificate chain when uploading a certificate for S/MIM…

…E in pkcs12 format. Include whole certificate chain in signed messages. Use whole certificate chain to verify certificates. Fixes #9190 Signed-off-by: Patrick Bender <[email protected]>
nextcloud · May 23, 2024 · 7bbe53b · 7bbe53b
1 parent 3351645
commit 7bbe53b
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 3 deletions.
diff --git a/lib/Service/SmimeService.php b/lib/Service/SmimeService.php
@@ -182,13 +182,16 @@ public function parseCertificate(string $certificate): SmimeCertificateInfo {
 			}
 		}
 
+		$decryptedCertificateFile = $this->tempManager->getTemporaryFile();
+		file_put_contents($decryptedCertificateFile, $certificate);
+
 		$caBundle = [$this->certificateManager->getAbsoluteBundlePath()];
 		return new SmimeCertificateInfo(
 			$certificateData['subject']['CN'] ?? null,
 			$certificateData['subject']['emailAddress'] ?? $certificateData['subject']['CN'],
 			$certificateData['validTo_time_t'],
 			$purposes,
-			openssl_x509_checkpurpose($certificate, X509_PURPOSE_ANY, $caBundle) === true,
+			openssl_x509_checkpurpose($certificate, X509_PURPOSE_ANY, $caBundle, $decryptedCertificateFile) === true,
 		);
 	}
 
@@ -376,13 +379,16 @@ public function signMimePart(Horde_Mime_Part  $part,
 			);
 		}
 
+		$decryptedCertificateFile = $this->tempManager->getTemporaryFile();
+		file_put_contents($decryptedCertificateFile, $decryptedCertificate);
+
 		$inPath = $this->tempManager->getTemporaryFile();
 		$outPath = $this->tempManager->getTemporaryFile();
 		file_put_contents($inPath, $part->toString([
 			'canonical' => true,
 			'headers' => true,
 		]));
-		if (!openssl_pkcs7_sign($inPath, $outPath, $decryptedCertificate, $decryptedKey, null)) {
+		if (!openssl_pkcs7_sign($inPath, $outPath, $decryptedCertificate, $decryptedKey, null, PKCS7_DETACHED, $decryptedCertificateFile)) {
 			throw new SmimeSignException('Failed to sign MIME part');
 		}
 

diff --git a/src/util/pkcs12.js b/src/util/pkcs12.js
@@ -51,7 +51,7 @@ export function convertPkcs12ToPem(pkcs12Der, password) {
 	}
 
 	return {
-		certificate: forge.pki.certificateToPem(certBags[0].cert),
+		certificate: certBags.map((a) => forge.pki.certificateToPem(a.cert)).join('\n'),
 		privateKey: forge.pki.privateKeyToPem(keyBags[0].key),
 	}
 }