OpenSSL engine: leaf certificates get O=Internet Widgits Pty Ltd, ST=Some-State from system openssl.cnf
维护者通常 1 天内回复
评估
调研方向
阅读OpenSslHandler::generateCertificate()中OpenSslHandler.php第182行附近创建叶证书 CSR 的代码，然后检查generateLeafConfig()以及根 CSR 的选项以作比较。使用提供的 PHP 代码片段复现问题，或在指定的 Nextcloud 镜像中生成叶证书。完成标准是叶证书的 subject 仅包含 LibreSign 设置或继承的字段，不包含系统 OpenSSL 默认值。
由索引模型根据 Issue 内容生成。
描述
Describe the bug
Signer certificates created with the OpenSSL engine contain O=Internet Widgits Pty Ltd and ST=Some-State, although the root certificate has neither field: the leaf CSR is created without a config, so openssl_csr_new fills missing DN fields with the *_default values of the system openssl.cnf.
To reproduce
- Official
nextcloud:35.0.2-apacheimage (Debian 13), certificate engine OpenSSL. - Generate the root certificate with only CN, C and L:
occ libresign:configure:openssl --cn=… --c=DE --l=… - Let a user create their signature certificate and sign a PDF.
pdfsig signed.pdfshows:
Signer full Distinguished Name: O=Internet Widgits Pty Ltd,ST=Some-State,CN=…,UID=account:…,OU=libresign-ca-id:…,L=…,C=DE
while the root subject is onlyC=DE, L=…, OU=libresign-ca-id:…, CN=….
Minimal PHP reproduction inside the container:
$k = openssl_pkey_new(['private_key_bits' => 2048]);
$c = openssl_csr_new(['commonName' => 'x', 'countryName' => 'DE'], $k, ['digest_alg' => 'sha256']);
print_r(openssl_csr_get_subject($c)); // CN, C, ST => Some-State, O => Internet Widgits Pty Ltd
Cause: in OpenSslHandler::generateCertificate() the CSR is created as createCsr($this->getCsrNames(), $privateKey, ['digest_alg' => 'sha256']), without a config option. PHP then falls back to the system openssl.cnf (Debian: stateOrProvinceName_default = Some-State, 0.organizationName_default = Internet Widgits Pty Ltd) and adds those defaults for every DN field not passed. The root CSR passes a config file via getRootCsrOptions() and is not affected.
Expected behavior
The leaf DN contains only the fields LibreSign sets (CN, UID and the fields inherited from the root); passing a config (e.g. the leaf config from generateLeafConfig()) to createCsr would fix it.
Screenshots
No response
Operational System
Docker, official nextcloud:35.0.2-apache image (Debian 13), on Kubernetes
Browser Type and Version
Not browser-related (server-side certificate generation)
Libresign Version
15.0.12 (still present on main, OpenSslHandler.php line 182)
Nextcloud Server Version
35.0.2
Logs from Nextcloud Server
No log entries: certificate generation succeeds, only the subject is wrong.
Logs from Developers tools
No response
Additional context
Workaround: set OPENSSL_CONF for the PHP processes to a file that includes the system config and points [req] distinguished_name to an empty section:
.include /usr/lib/ssl/openssl.cnf
[ req ]
distinguished_name = req_dn_libresign
[ req_dn_libresign ]
With it, the CSR contains only the passed fields; TLS from PHP keeps working. Certificates issued before keep the placeholder until the user recreates their certificate.
- 主要语言
- PHP
- 星标
- 844
- 派生
- 176
- 平均合并
- 13 小时 46 分钟
- 30 天内合并 PR
- 299
环境准备
在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
LibreSign/libresign 的其他 Issue
-
backend enhancement good first issue php
难度 2/5 1-3 小时 新手友好度 82/100
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 83/100
LibreSign/libresign#9007 · 2 条评论 · 1 个 reaction ·
维护者通常 1 天内回复
-
good first issue
难度 2/5 1-3 小时 新手友好度 78/100
LibreSign/libresign#8284 · 5 条评论 ·
维护者通常 1 天内回复
-
backend enhancement php
难度 5/5 一周以上 新手友好度 12/100
维护者通常 1 天内回复
-
backend enhancement php
难度 5/5 一周以上 新手友好度 12/100
维护者通常 1 天内回复
查看 LibreSign/libresign 的全部 Issue
相似的 Issue
-
难度 1/5 1 小时以内 新手友好度 89/100
backdrop-contrib/commerce#65 ·
-
enhancement good first issue help wanted
难度 2/5 1-3 小时 新手友好度 78/100
Evalogical-Inc/devReady#66 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
mollie/PrestaShop#1627 ·
维护者通常 5 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 72/100
FriendsOfFlarum/follow-tags#118 ·
-
WebP — PHP 8.5 deprecation "Using null as an array offset" in url_to_path() for relative image URLs未关闭✨️ai-candidate effort: [XS] module: webp cache priority: low type: bug
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复