How can I verify that all certificates in the chain are combined to create a chain of trust to a trusted root CA certificate?


Caio Lins

So I'm trying to manually validate a request for an Alexa skill I'm developing, but can't "verify that all certificates in the chain are combined to create a chain of trust to a trusted root CA certificate". As shown in step 3.c of the documentation .

Working with these certificates is completely new territory for me, and since I've built up this skill without using the suggested Amazon Ask-SDK, I figured it would be faster to implement the verification manually instead of adapting my skills to using the SDK. But now I'm stuck and need help.

I don't quite understand how caStore works and think I may not be initializing it properly. I've tried using the Amazon Signing certificate provided in the skill request along with the two root certificates (URLs in the code) without success.

this is the code

const rp = require('request-promise')
const pki = require('node-forge').pki

const AlexaSkill = {
    validate: async (request) => {

        if (request.headers) {            
            
            const signature = request.headers.signature
            const signatureCertChainUrl = request.headers.signaturecertchainurl
            if (signature && signatureCertChainUrl) {
                
                let urlPieces = signatureCertChainUrl.replace('../', '').split('echo.api/')
                if (urlPieces.length > 1) {
                    
                    const normalizedUrl = `${urlPieces[0]}echo.api/${urlPieces[urlPieces.length - 1]}`
                    if (normalizedUrl.startsWith('https://s3.amazonaws.com:443/echo.api/') || normalizedUrl.startsWith('https://s3.amazonaws.com/echo.api/')) {
                        
                        const pem = await rp(signatureCertChainUrl)
                        const amazonSigningPem = pem.substring(0, pem.indexOf('END CERTIFICATE-----\n') + 21)
                        const amazonSigningCert = pki.certificateFromPem(amazonSigningPem)

                        const pem1 = await rp('https://www.amazontrust.com/repository/AmazonRootCA1.pem')
                        const amazonRootCert1 = pki.certificateFromPem(pem1)                        
                        const pem2 = await rp('https://www.amazontrust.com/repository/AmazonRootCA2.pem')
                        const amazonRootCert2 = pki.certificateFromPem(pem2)
                        // const pem3 = await rp('https://www.amazontrust.com/repository/AmazonRootCA3.pem')
                        // const amazonRootCert3 = pki.certificateFromPem(pem3)
                        // const pem4 = await rp('https://www.amazontrust.com/repository/AmazonRootCA4.pem')
                        // const amazonRootCert4 = pki.certificateFromPem(pem4)

                        const caStore = pki.createCaStore([ amazonSigningCert ])
                        const caStore1 = pki.createCaStore([ amazonRootCert1 ])
                        const caStore2 = pki.createCaStore([ amazonRootCert2 ])
                        // const caStore3 = pki.createCaStore([ amazonRootCert3 ])
                        // const caStore4 = pki.createCaStore([ amazonRootCert4 ])

                        const certChain = pem.substring(pem.indexOf('END CERTIFICATE-----\n') + 21)
                            .split('-----END CERTIFICATE-----\n')
                            .filter(cert => cert.length > 0)
                            .map(cert => pki.certificateFromPem(`${cert}-----END CERTIFICATE-----\n`))

                        try {
                            const v = pki.verifyCertificateChain(caStore, certChain)
                            console.log('Passed!', v)
                        } catch (e) {
                            console.log('Error!', JSON.stringify(e))
                        }

                        try {
                            const v1 = pki.verifyCertificateChain(caStore1, certChain)
                            console.log('Passed!', v1)
                        } catch (e) {
                            console.log('Error!', JSON.stringify(e))
                        }

                        try {
                            const v2 = pki.verifyCertificateChain(caStore2, certChain)
                            console.log('Passed!', v2)
                        } catch (e) {
                            console.log('Error!', JSON.stringify(e))
                        }
                    }
                }
            }
        }

        return false
    }
}

and output

mistake! {"message": "Certificate not trusted.", "error": "forge.pki.UnknownCertificateAuthority"}

mistake! {"message": "Certificate not trusted.", "error": "forge.pki.UnknownCertificateAuthority"}

mistake! {"message": "Certificate not trusted.", "error": "forge.pki.UnknownCertificateAuthority"}

Thanks in advance.

Related


Can I create a certificate chain from a root CA

wheat This may sound like a stupid question, but this is my first time working on this topic. Is it possible to create a certificate chain. So currently we have this structure: Root CA --> Intermediate CA --> Issues certificates Here is the structure we want:

Can I create a certificate chain from a root CA

wheat This may sound like a stupid question, but this is my first time working on this topic. Is it possible to create a certificate chain. So currently we have this structure: Root CA --> Intermediate CA --> Issues certificates Here is the structure we want:

How to verify certificate chain from specific root CA in C#

Tanas I have a certificate chain that looks like this: root CA -> intermediate CA -> client certificate. How can I verify that the "root CA" explicitly created the received certificate? Verifying the entire chain is not a problem. It can be done like this: X50

How to verify certificate chain from specific root CA in C#

Tanas I have a certificate chain that looks like this: root CA -> intermediate CA -> client certificate. How can I verify that the "root CA" explicitly created the received certificate? Verifying the entire chain is not a problem. It can be done like this: X50

How to verify certificate chain from specific root CA in C#

Tanas I have a certificate chain that looks like this: root CA -> intermediate CA -> client certificate. How can I verify that the "root CA" explicitly created the received certificate? Verifying the entire chain is not a problem. It can be done like this: X50

How to verify certificate chain from specific root CA in C#

Tanas I have a certificate chain that looks like this: root CA -> intermediate CA -> client certificate. How can I verify that the "root CA" explicitly created the received certificate? Verifying the entire chain is not a problem. It can be done like this: X50

How to verify certificate chain from specific root CA in C#

Tanas I have a certificate chain that looks like this: root CA -> intermediate CA -> client certificate. How can I verify that the "root CA" explicitly created the received certificate? Verifying the entire chain is not a problem. It can be done like this: X50

How to verify certificate chain using CA certificate C#

Daigo Yamamoto I am trying to connect to a Mosquitto proxy. The agent will have a ca.crt and a server.crt. My application will only have ca.crt. Once connected, the proxy provides ca.crt and server.crt (certificate chain). How can I verify both against the ca.

Why can't I verify this certificate chain?

Zhong Bo I have a chain of three certificates: root.pem middleware John Paym When I checked with them, openssl x509 -in [filename] -text -nooutthey looked fine, the root.pem looked like it was self-signed (Issuer == Subject), and the Subject of each certificat

Why can't I verify this certificate chain?

Zhong Bo I have a chain of three certificates: root.pem middleware John Paym When I checked with them, openssl x509 -in [filename] -text -nooutthey looked fine, the root.pem looked like it was self-signed (Issuer == Subject), and the Subject of each certificat

Should trusted root CAs be part of the certificate chain?

Mike I am establishing 2-way SSL communication between services on different hosts. Suppose I have a CA of my own, called A. All my services trust A through centralized jks. Now suppose I have a certificate B signed by A. When services send certificates, shoul