OpenSSL changed format of x509 outputs

[tofu-rocketry]

Default output format has changed between OpenSSL versions 1.0.2 and 1.1.1. The -nameopt argument can be used, but it seems to have inconsistent results if you use the -nameopt compat format. There is the option of "negated" format options, e.g -nameopt -online, but can't find a combo that helps. This implies we'd need to check what version of OpenSSL is being used, or change the format of the subject strings everywhere.

1.0.2:

$ openssl x509 -noout -subject < /etc/grid-security/certificates/UKeScienceCA-2B.pem
subject= /C=UK/O=eScienceCA/OU=Authority/CN=UK e-Science CA 2B

$ openssl x509 -noout -nameopt compat -subject < /etc/grid-security/certificates/UKeScienceCA-2B.pem
subject= C=UK, O=eScienceCA, OU=Authority, CN=UK e-Science CA 2B

$ openssl x509 -noout -nameopt oneline -subject < /etc/grid-security/certificates/UKeScienceCA-2B.pem
subject= C = UK, O = eScienceCA, OU = Authority, CN = UK e-Science CA 2B

$ openssl x509 -noout -nameopt -oneline -subject < /etc/grid-security/certificates/UKeScienceCA-2B.pem
subject= C=UK, O=eScienceCA, OU=Authority, CN=UK e-Science CA 2B

1.1.1:

$ openssl x509 -noout -subject < /etc/grid-security/certificates/UKeScienceCA-2B.pem
subject=C = UK, O = eScienceCA, OU = Authority, CN = UK e-Science CA 2B

$ openssl x509 -noout -nameopt compat -subject < certificate.crt
subject=/C=UK/L=Didcot/O=RAL/CN=this

$ openssl x509 -noout -nameopt oneline -subject < /etc/grid-security/certificates/UKeScienceCA-2B.pem
subject=C = UK, O = eScienceCA, OU = Authority, CN = UK e-Science CA 2B

$ openssl x509 -noout -nameopt -oneline -subject < /etc/grid-security/certificates/UKeScienceCA-2B.pem
subject=/C=UK/O=eScienceCA/OU=Authority/CN=UK e-Science CA 2B

[jrha]

See openssl/openssl#5605

https://frasertweedale.github.io/blog-redhat/posts/2019-05-28-a-dn-is-not-a-string.html

[tofu-rocketry]

I've added the compat outputs for the different versions above. As you can see, compat isn't compatible!

CentOS 8 cloud VM seems to have 1.1.1 so it may be an issue sooner than we'd like. 🤔

[root@apel-centos-8-test ~]# rpm -aq | grep openssl
openssl-1.1.1c-15.el8.x86_64
openssl-pkcs11-0.4.10-2.el8.x86_64
openssl-libs-1.1.1c-15.el8.x86_64

I guess the fix is to take whatever input we get, break it down to a list or dict and compare those.

[jrha]

I think you should consider using PyOpenSSL.