You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Description x509.create_csr by default sets the version to 3, which is invalid for CSR (only 1 exists). Trying to import such a CSR with more strict libraries fails (latest versions of cryptography, whatever Go library Vault uses).
>>> import cryptography>>> cryptography.__version__'38.0.3'>>> a = """-----BEGIN CERTIFICATE REQUEST-----... MIICVjCCAT4CAQIwADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM5+... 0OS8+xIy2I475qlgxEqqSP28BncqlRG1d1VjB4Xc22K+QHS2ipeFM6NRlO2OytYy... qMMgqU1lKU7sJXxw/uXfNMP40G3t5hrI8O/KtVbIYwujVkswgEMg4bZvmOSjyqte... BbOH4baQK+7P8LN8Ceaja6d5QAWKBvKSD8f8X1khZP8Lw0rUJjOFWi+XIrEsyd8d... gern7Qw6ATdFvLs7aY5p2AliUhp1zlqkBJqNcqpLQZubVlg8w1ABfzwFRvTslGio... SCoCA0MJ0QyThgHjJIqpvZGVdrD4ZQP4rXZHMv8Qzquolpou0n984oCk8t3qyaR+... WmJIdcPtmMYr8Y6YGKcCAwEAAaARMA8GCSqGSIb3DQEJDjECMAAwDQYJKoZIhvcN... AQELBQADggEBAEwUc47pXGCNLmZSKAhDu4FbrVyW+PrdWGYKBI+onycy7wCqDP9c... vQ4lGeuG3t074drgKvm9fIDUdTZLqDDXD2kOAW+7AYbRYxUvTxMiDyrsqyH+N590... S+SucVJzEZTVNqrWLMn4JwOuXf4onuAxtFLOY+dSGbpU6CiFbaXk6qDDsankqn0Y... TsAWx3PqeU2w9CT3a68rW214Avn1aMP+aCMHZ7QQpnTnRKXVZscOjiY6MT9Yb8Nv... BldjvVnQN7bCjM2TQTMSbd00lD+071hLm6ceDQdoewbipNKyhBnQd4hFYJgDPQR7... 1OVnGCilmno3MkKW4yztBX2gI2ifXSaunmY=... -----END CERTIFICATE REQUEST-----""">>> from cryptography import x509>>> x509.load_pem_x509_csr(a.encode())Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/Users/jeanluc/.local/share/asdf/installs/python/3.10.4/lib/python3.10/site-packages/cryptography/x509/base.py", line 535, in load_pem_x509_csr return rust_x509.load_pem_x509_csr(data)cryptography.x509.base.InvalidVersion: 2 is not a valid CSR version
Expected behavior
Default to the correct version 1
Versions Report
salt --versions-report
(Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)
Salt Version:
Salt: 3005.1Dependency Versions:
cffi: Not Installedcherrypy: Not Installeddateutil: 2.8.1docker-py: Not Installedgitdb: Not Installedgitpython: Not InstalledJinja2: 3.0.3libgit2: Not InstalledM2Crypto: 0.37.1Mako: Not Installedmsgpack: 1.0.0msgpack-pure: Not Installedmysql-python: Not Installedpycparser: Not Installedpycrypto: Not Installedpycryptodome: 3.9.7pygit2: Not InstalledPython: 3.9.2 (default, Feb 28 2021, 17:03:44)python-gnupg: Not InstalledPyYAML: 5.3.1PyZMQ: 20.0.0smmap: Not Installedtimelib: Not InstalledTornado: 4.5.3ZMQ: 4.3.4System Versions:
dist: debian 11 bullseyelocale: utf-8machine: x86_64release: 5.10.0-18-amd64system: Linuxversion: Debian GNU/Linux 11 bullseye
The text was updated successfully, but these errors were encountered:
Description
x509.create_csr
by default sets the version to3
, which is invalid for CSR (only1
exists). Trying to import such a CSR with more strict libraries fails (latest versions ofcryptography
, whatever Go library Vault uses).Setup
Steps to Reproduce the behavior
Expected behavior
Default to the correct version 1
Versions Report
salt --versions-report
(Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)The text was updated successfully, but these errors were encountered: