Re: [Sidrops] Test objects: ASPA and BGPSec Router Certificate

> On 23 Jul 2022, at 14:37, Job Snijders <job=40fastly.com@dmarc.ietf.org> wrote:
> 
> Hi Tim,
> 
> On Fri, Jul 22, 2022 at 03:02:38PM +0200, Tim Bruijnzeels wrote:
> 
>> I just published a BGPSec Router Certificate and an ASPA
>> object under a test CA in our testbed. The CA uses the
>> following rsync base:
>> 
>> rsync://testbed.krill.cloud/repo/local-testbed-child/0/
>> 
>> The TAL for this testbed lives here:
>> https://testbed.krill.cloud/testbed.tal
> 
> There seems to be a logistical issue with the testbed:
> 
> The TAL file 'testbed.tal' references
> rsync://testbed.krill.cloud/ta/ta.cer, which in turn references
> rsync://testbed.krill.cloud/repo/ta/0/1EB6897DBC368F678703F36607DFAB5C89AE8CD7.mft,
> which does not exist:
> 
> $ rsync rsync://testbed.krill.cloud/repo/ta/0/1EB6897DBC368F678703F36607DFAB5C89AE8CD7.mft
> rsync: link_stat "/ta/0/1EB6897DBC368F678703F36607DFAB5C89AE8CD7.mft" (in repo) failed: No such file or directory (2)

Ah, oops.. the TA cert and TAL live outside of the normal set of objects that get
published. It requires a manual action that I forgot when I reset this environment
a while back.

That is now fixed, but I found another issue with the (release candidate) code
running here.. fixing..

> 
>> BGPSec:
>> -------
>> 
>> file: ROUTER-00033979-17316903F0671229E8808BA8E8AB0105FA915A07.cer
>> 
>> This is valid according to our own probing, but please let
>> me know if you find any issues with it.
> 
> The SIA extension of the EE cert in
> ROUTER-00033979-17316903F0671229E8808BA8E8AB0105FA915A07.cer is empty.
> 
> $ openssl x509 -in ./ROUTER-00033979-17316903F0671229E8808BA8E8AB0105FA915A07.cer -inform DER -text | grep -A1 'Subject Information'
>            Subject Information Access:
>                <EMPTY>
> 
> The empty SIA renders the BGPsec Router Key certificate invalid for two
> reasons:
> 
> 1/ Iff a SIA is present in an EE certificate, according to RFC 6487 §
>   4.8.8.2 it MUST have an instance of accessMethod of id-ad-signedObject.
> 
> 2/ Additionally, RFC 8209 § 3.3 states: "BGPsec Router Certificates MUST
>   NOT include the SIA extension."
> 
> I recommend testing with RPKI Cache Validator implementations known to
> support BGPsec Router Key validation (such as rpki-client).
> 
> Testing with multiple independent implementations helps improve
> interopability, and also  discover issues early in the development
> process when authoring a CA implementation.
> 
> Rpki-client's error log messages can be hard to interpret (my
> apologies!), however the absence of a BGPsec Router key in the validated
> JSON output might be a good hint something went wrong in producing a
> given cryptographic product.
> 

Sure thanks for the pointer. Will work on a fix and first try to test
it with rpki-client as well.

Tim

> Kind regards,
> 
> Job
> 
> _______________________________________________
> Sidrops mailing list
> Sidrops@ietf.org
> https://www.ietf.org/mailman/listinfo/sidrops