Uncaught (in promise) CryptoServerError: Cannot parse Certificate or Certificate Request from incoming ASN1

[antonioaraujob]

Dear Friends of Fortity,
I hope you are fine.

I am testing fortify-examples using a SafeNet 5110 USB token for generating a CSR.

When I open https://peculiarventures.github.io/fortify-examples/example1.html the web page lists the provider (SafeNet eToken 5100), however when I try to create the CSR I see the following in the Browser’s console:

It seems the CSR object was created but the importCert() function fails.

// Convert request to DER
const derRequest = request.toSchema(true).toBER(false);
const base64 = DerToPem(derRequest, "CERTIFICATE REQUEST");
console.log(base64);

// import key to crypto
const req = await crypto.certStorage.importCert("request", derRequest, alg, ["sign", "verify"]);

I also checked the Fortify’s log and I could see the following:

Could you please guide me on how to fix this issue?

Is this related to a dependency version?

I have a little doubt about CSR generation process. Please excuse me if this is a basic question but I understand that WebCrypto is using the Provider to generate the key pair, so I would like to know why we have to import the CSR and keys as follows:

// import key to crypto
const req = await crypto.certStorage.importCert("request", derRequest, alg, ["sign", "verify"]);

// add keys and request to storage
const privateKeyIndex = await crypto.keyStorage.setItem(keys.privateKey);
const publicKeyIndex = await crypto.keyStorage.setItem(keys.publicKey);
const requestIndex = await crypto.certStorage.setItem(req);

Best regards

Antonio

[donskov]

@antonioaraujob Hello and thank you for the issue. Related for me too on NSS Certificate DB provider. We will investigate what happened.

[antonioaraujob]

Hello @donskov, thanks for your comments and your time.

Yes, you are right. I also saw the same behavior for MacOS Crypto provider:

and NSS Certificate DB provider:

Best regards

[donskov]

@antonioaraujob I think the problem was fixed. Please try to run the example again.

[antonioaraujob]

Dear @donskov, I hope you are fine.
I run the example again and it worked for MacOS Crypto provider:

and SafeNet eToken 5100 provider:

For NSS Certificate DB I got the following:

Thank you very much for the support.

Best regards

[donskov]

@microshine Hey. Do you know anything about it? Maybe NSS Certificate DB doesn't support CSR?

[microshine]

We are using CKO_DATA for CSR keeping. As I can remember NSS doesn't support that type of objects

[rmhrisk]

Then sounds like we need to come up with an alternative way for NSS?