X.509 request Cert chain validation plug for Alexa Skills

The first place I’d look is the crypto module in the erlang main distribution. You have access to it off the bat, you just have to do Application.start :crypto. There’s also the public_key module that seems related.

Except that will not include it in a release, instead you want to add it to the (extra) applications list in your mix.exs file, that way it will both be included in release as well as loaded.

Yes, obviously I meant for when he wants to check it out in iex. It’s not even started in a normal iex session, nor is it accessible for autocomplete, hence the suggestion.

There’s a trick. If you do

iex> h :crypto

the module will be loaded and then the tab completion will work.

Thank you guys very much! public_key is definitely the library I want to use. I am not sure I even need the RSA library/application which is great.

I am totally inexperienced with Erlang unfortunately and cannot seem to get it all working via iex. I am wondering what I am doing wrong.

Here’s what I got:

Application.ensure_all_started :inets
Application.ensure_all_started :ssl

\# amazon cert chain
{:ok, resp} = :httpc.request(:get, {'https://s3.amazonaws.com/echo.api/echo-api-cert.pem', []}, [], [body_format: :binary])
{{_, 200, 'OK'}, _headers, certificate_chain_bin} = resp
cert_chain = :public_key.pem_decode(certificate_chain_bin)

\# root cert
{:ok, resp} = :httpc.request(:get, {'https://www.symantec.com/content/dam/symantec/docs/other-resources/verisign-class-3-public-primary-certification-authority-g5-en.pem', []}, [], [body_format: :binary])
{{_, 200, 'OK'}, _headers, root_cert} = resp
[root_cert_decoded] = :public_key.pem_decode(root_cert)

foo = :public_key.pkix_path_validation(root_cert_decoded, cert_chain, nil)

No matter what I put in (nil, or a function call, etc…) it is returning with an error of some sort.

It looks like the erlang library is asking me to pass a function as part of the options but when I try to send it, it complains. I have tried looking at the Erlang codebase but could not identify the problem (let alone if I am using the correct version of Erlang :)). Thoughts on what I am doing wrong?

I have also tried the following but to no avail:

verify_fun = fn(cert, event, state) -> { :valid, state} end
foo = :public_key.pkix_path_validation(:RSA, cert_chain, [{:verify_fun, verify_fun}])

Docs are here:

Thanks in advance if you are able to figure out what I am doing wrong!

Ok. Made some progress. it looks like all of the path_validation needed to be converted to otp style certificates. Working on an update which I hope to post if I get it actually working. Oy!

I’m not familiar with X.509 but based on my experience with ssl cert verification I think you are supposed to do just a bit more work on the result of :public_key.pem_decode.

I created a quick script here public_key_verify.exs · GitHub, run it with elixir public_key_verify.exs. I got a bunch of errors printed out inside verify_fun, the echo cert has expired.

Thanks, xlphs!

I got one step further on my own but am still stuck. The live valid certificate is at : https://s3.amazonaws.com/echo.api/echo-api-cert-4.pem

And I think the trusted cert should be: https://www.symantec.com/content/dam/symantec/docs/other-resources/verisign-class-3-public-primary-certification-authority-g4-en.pem

Unfortunately, if I change the URLs in your script I still get :invalid_issuer, :invalid_key_usage, :invalid_signature errors.

I am guessing we might have the wrong trusted cert, but no matter what I try I get the same errors. (I have tried multiple root certs).

In any case, that’s my current blocking point. Feels like I should not be ignoring those errors

The trust anchor is actually the root certificate from @xlphs’s script, the one ending with “G5”. One way to verify how the various certificates relate is to use OpenSSL’s CLI:

cat cert.pem | openssl x509 -text -noout

You can either compare the Subject and Issuer RDNs, or check if the Authority Key Identifier matches the Subject Key Identifier of the issuing cert. Note that you’d have to split Amazon’s PEM file into two files to be able to pipe each on into OpenSSL.

The other thing to note is that pkix_path_validation expects the certificate chain to be in the opposite order of what’s in the file from Amazon, with the peer cert at the end:

CertChain = [der_encoded()]
A list of DER-encoded certificates in trust order ending with the peer certificate.

So make sure you pass the list through Enum.reverse/1 first.

Awesome! It worked! I thought the certs were in order and not reversed.

One other question - is there any way to access an erlang set of Trusted certificates or do I just need to build out a list myself since this is a lower level library? I noticed the ssl package has trusted certs but could not find a way to access it directly. No worries if not. I think it is fine to just download or cache the one I need for now.

Thanks again everyone!