Check for Weak Debian Keys

The following describes how to check for weak Debian keys on the EJBCA Hardware Appliance.

The instructions have been tested against the EJBCA Hardware Appliance version 3.2.0.

Background

Due to an issue (CVE-2008-0166) from 2006 in OpenSSL, where a vulnerable version of the library only used the PID as seed when generating RSA or DSA keys, an attacker can find the private key from the corresponding public without much effort. The Debian project created blacklists and you can check certificates against these blacklists to check for weak Debian keys.

Create Script on the Appliance

To create a script on the Hardware Appliance:

Go to the Appliance WebConf, click Platform > Platform access and enable SSH.
Transfer the file debian-weak-keys.tar.xz to the appliance using e.g. WinSCP.
Log in using SSH and transfer the file debian-weak-keys.tar.xz to cos-ejbca.

Replace MGMT_IP with the IP address of the management interface shown on the appliance front display.
```
ssh root@MGMT_IP
scp debian-weak-keys.tar.xz cos-ejbca:
```
CODE
Jump to cos-ejbca.
```
ssh cos-ejbca
```
CODE
Create directories in /etc.
```
mkdir -p /etc/weak-keys/all-lists
```
CODE

Extract the file with the Debian blacklists.

tar -C /etc/weak-keys/all-lists -xf debian-weak-keys.tar.xz

CODE

Create a script which can be attached to a validator in EJBCA.

/etc/weak-keys/weak-keys.sh

#!/bin/sh
output=`grep $(openssl x509 -noout -pubkey -inform DER -in $1 \
    | openssl rsa -pubin -noout -modulus \
    | sha1sum | cut -d ' ' -f 1 | cut -c 21-) \
    /etc/weak-keys/all-lists/blacklist*`
if [ -z "$output" ]; then
  logger "The public key in the certificate is not on a known weak Debian key."
  exit 0
else
  logger "Known weak Debian key was detected in certificate."
  logger "You can inspect the base64 encoded certificate shown below:"
  logger `cat $1 | base64`
  exit 1
fi

BASH

Set permissions for WildFly.

chown -R user:user /etc/weak-keys
chmod +x /etc/weak-keys/weak-keys.sh

CODE

Create External Command Certificate Validator

To create an External Command Certificate Validator:

Open the EJBCA Enterprise. In the sidebar, in the System Configuration section, select System Configuration.
In the window System Configuration chose External Scripts from the menu bar.
Select Enable External Script Access by check marking Activate. Next configure the Configure Scripts Allow List according to the following example.
To ensure that the script path(s) is(are) correct and can be executed click Validate.
If no error message appears, click Save to save the configuration.
Go to Validators and create an external command certificate validator with the following settings:
- Validator Type: External Command Certificate Validator.
- Full pathname of script: /etc/weak-keys/weak-keys.sh.
- Fail on script error code: Enabled.
- Fail on output to error out: Enabled.
- Issuance Phase: Pre-certificate Validation.
- If Validation failed: Abort certificate issuance.
Save the validator.

Test Validator

To test the validator:

To test if your setup works, edit the validator created in the previous section.

Copy-paste the PEM certificate shown below and save it as a file called test-blacklist.pem.

CODE

Upload test-blacklist.pem and click Test command.

Expected log output in the syslog of cos-ejbca:

> tail -f /var/log/sys.log
Jun 24 17:29:16 cos-ejbca root: Known weak Debian key was detected in certificate.
Jun 24 17:29:16 cos-ejbca root: You can inspect the base64 encoded certificate shown below:
Jun 24 17:29:16 cos-ejbca root: <base64 encoded certificate>

CODE

Expected output of the WildFly log file:

17:29:16,247 INFO  [org.cesecore.keys.validation.ExternalCommandCertificateValidator] (ajp--0.0.0.0-8009-4) Test external command certificate validator Debian Weak Key Check
17:29:16,295 INFO  [org.cesecore.keys.validation.ExternalCommandCertificateValidator] (ajp--0.0.0.0-8009-4) Could not call external command '/etc/weak-keys/weak-keys.sh' with arguments [/tmp/org.cesecore.keys.validation.ExternalCommandCertificateValidator-1593012556248505049562192935548.tmp] sucessfully: Detected errors while running the external application /etc/weak-keys/weak-keys.sh.

CODE

The message Could not call external command means that the script returned a non-zero exit status, which is the expected behavior when the certificate contains a weak Debian key.

Enable Validator for a CA

To enable the validator for a CA:

Go to Certification Authorities and select the CA for which you want to enable the validator.
In the Other Data section, select the validator you just created and click Save. The validator will now run every time you issue a certificate from this CA.

Maintenance Notes

The script and the blacklists will be wiped after a factory reset of the appliance. If you perform a factory reset and restore a backup, you must add the script and the blacklists again. If you forget to do so, the validation will fail.

If you have a CA cluster, you need to add the script and the blacklists to all nodes in the cluster. The files in /etc are not automatically synchronized between the nodes.