Changing the private key and certificate for an existing certificate variable causes exception about credhub HOT 17 CLOSED

Ok, thanks for following up. We'll try to reproduce on our end and see if we can figure out what's going on.

from credhub.

@axelaris we were able to reproduce this issue using CredHub 2.0.2 and also verified that is is fixed in version 2.4.0:

$ credhub --version
CLI Version: 2.5.1
Server Version: 2.0.2

$ credhub set -t certificate -n letsencrypt -p privkey.pem -c fullchain.pem -r chain.pem
The provided key format is not supported. Keys must be PEM-encoded PKCS#1 keys.

$ credhub --version
CLI Version: 2.5.1
Server Version: 2.4.0

$ credhub set -t certificate -n letsencrypt -p privkey.pem -c fullchain.pem -r chain.pem
id: bfa164d8-6856-408a-9010-53d3e42414bd
name: /letsencrypt
type: certificate
value: <redacted>
version_created_at: "2019-06-28T15:19:14Z"

It seems like the issue is that we didn't support PKCS#8 keys in CredHub 2.0.2, but we also only checked the format when both a cert and key were specified. Upgrading to the latest CredHub (or at least to 2.2.0) should fix your issue. Feel free to reopen if you are still experiencing after upgrading.

from credhub.

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/157328156

The labels on this github issue will be updated when the story is started.

from credhub.

@matt-royal Looks like CredHub has trouble with cert chains! We will prioritize this issue as necessary. Thanks for submitting!

from credhub.

@matt-royal Out of curiosity, have you had the opportunity to try this out on 1.7+? I ask because 1.6 is out of support at this point, but I imagine the issue does affect these versions. If you haven't, we'll try to repro for the latest versions on our side.

from credhub.

Hi @crawsible. I haven't had a chance to try this recently.

from credhub.

@crawsible @matt-royal This is still an issue in 1.7+

from credhub.

Hey @matt-royal - I know we are almost a year after your opening of this issue, but I want to follow up here. Were you able to get this working in later versions of CredHub? I just tried on our latest release and I got a different error, but I think it is because we tightened our validation of cert/private key pairs.

from credhub.

Closing due to inactivity. Please feel free to reach out again if this issue arises, thanks!

from credhub.

Seriously? Closed due to inactivity without fixing that out?

from credhub.

@axelaris could you help us understand your use case? Why do you need to have a chain stored in the certificate field?

from credhub.

Hi @mdelillo,
thank you for asking.
Today I tried to replace a generated self-signed Concourse certificate with a real one, signed by Letsencrypt. And this is what I got:

$ credhub set -n /bosh-controlplane/concourse/atc_tls -t certificate -p "`cat /etc/letsencrypt/live/mydomain/privkey.pem`" -c "`cat /etc/letsencrypt/live/mydomain/fullchain.pem`" 
The provided key format is not supported. Keys must be PEM-encoded PKCS#1 keys.

So, as I understand, it is still no way to put my own cert to Credhub?

from credhub.

My understanding is that the chain would go in the ca field because that is being used for trust, and the single certificate (cert.pem) would go in the certificate field. We verified that you are able to store a chain in the ca field as long as the CA that signed the cert is the first one in the chain.

from credhub.

Hi @mdelillo ,
thank you for answer, but I'm pretty sure that I've tried that way also:

$ credhub set -n /bosh-controlplane/concourse/atc_tls -t certificate -p "`cat atc_tls_lets.key`" -c "`cat atc_tls_lets.cert`" -r "`cat atc_tls_lets.ca`"
The provided key format is not supported. Keys must be PEM-encoded PKCS#1 keys.

from credhub.

Hi @axelaris, I misread that error message. It looks like your private key is not PKCS#1. In CredHub 2.2.0 we added support for PKCS#8 keys, do you know what format your key is and what version of CredHub you are using?

from credhub.

Hi @mdelillo, I'm using Credhub v2.0.2 (server) and 2.0.1 (CLI).
And I'm pretty sure the case is not a key format, because I'm able to upload a key only:

$ credhub set -n /bosh-controlplane/concourse/atc_tls -t certificate -p "`cat atc_tls_lets.key`" 
id: 1dbd5838-9f2d-43b9-b61e-4b36dc76e0c2
name: /bosh-controlplane/concourse/atc_tls
type: certificate
value: <redacted>
version_created_at: "2019-06-27T11:32:01Z"

$ credhub get -n /bosh-controlplane/concourse/atc_tls 
id: 1dbd5838-9f2d-43b9-b61e-4b36dc76e0c2
name: /bosh-controlplane/concourse/atc_tls
type: certificate
value:
  ca: null
  certificate: null
  private_key: |-
    -----BEGIN PRIVATE KEY-----
 ... skipped ...
    -----END PRIVATE KEY-----
version_created_at: "2019-06-27T11:32:01Z"

from credhub.

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/166979969

The labels on this github issue will be updated when the story is started.

from credhub.