How to access the winstore in OpenSSL 3.2.0-beta2

[mkazia-db]

Hello,

I'm trying to read/load the Windows Cert store to verify a s_client connection on a windows machine and I'm not able to figure it how. I tried setting environment variables:

SSL_CERT_URI=org.openssl.winstore://
SSL_CERT_DIR=org.openssl.winstore://
SSL_CERT_FILE=org.openssl.winstore://

I also tried to use the storeutl to load the certs from the Windows cert store, and it returns an empty list (errors if I give an invalid URI) openssl storeutl -text -noout org.openssl.winstore://

If I run openssl engine capi -t -post store_name:ROOT -post list_certs
I can see the complete list of root certs from the Windows cert store.

My version of Openssl is

OpenSSL 3.2.0-beta2-dev  (Library: OpenSSL 3.2.0-beta2-dev )
built on: Tue Nov  7 07:35:28 2023 UTC
platform: VC-WIN64A
options:  bn(64,64)
compiler: cl  /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC
OPENSSLDIR: "C:\Program Files\Common Files\SSL"
ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"
MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"
Seeding source: os-specific
CPUINFO: OPENSSL_ia32cap=0xfffa32035f8bffff:0x8d19e47ab

What is the right way to use this?

[levitte]

org.openssl.winstore is a very simple store implementation indeed. It does not know how to list all the available certs. What it does know is how to find certs given a subject.

openssl storeutl -text -noout org.openssl.winstore:// -subject "CN=whatever"

Internally, CertFindCertificateInStore() is used with dwFindType = CERT_FIND_SUBJECT_NAME. According to docs for that find type, you must give an exact and complete subject.

It should be possible to enhance org.openssl.winstore to be a bit more flexible... you might also want to try https://github.com/Lipovlan/cng-openssl-provider by @Lipovlan, it does a bit more.

[mkazia-db]

Thanks @levitte for the reply. I figured the right way to use the -subject format and tested it with file:// directory store and confirmed it works. However, when I use the same subject for the same cert that is imported in the windows cert store it does not return any results with the org.openssl.winstore:// store. It seems to me that org.openssl.winstore:// store is not functioning.

[levitte]

@hlandau, can you take a look at this?

[mkazia-db]

I just want to update here that with the s_client command using -CAstore org.openssl.winstore:// option does work. It was able to verify a server cert chain with the root CA certificate stored in the windows ROOT cert store. I'm just not able to use the winstore with storeutl command.

[ToniA]

I'm also struggling with this, when attempting to debug mTLS handshake issues.

I am able to debug this with cURL, but it does not tell me anything about the mTLS handshake (4f8c1...2d05 is the thumbprint of a certificate stored in a smartcard). It will prompt for the smartcard PIN, and the mTLS autentication works.
curl -i --cert "CurrentUser\\MY\\4f8c1...2d05" --trace-ascii - https://idcard-login.ourdomain.com

I'm attempting to dig deeper with OpenSSL 3.3.0 9 Apr 2024, platform: VC-WIN64A, but how do I point it to a certain certificate in the CurrentUser\Personal\Certificates?

This responds with 400 BAD REQUEST No required SSL certificate was sent:
"C:\Program Files\Git\usr\bin\echo.exe" -e "GET / HTTP/1.1\r\nHost: idcard-login.ourdomain.com\r\nUser-Agent: curl/8.4.0\r\nAccept: */*\r\n\r\n" | openssl s_client -showcerts -connect idcard-login.ourdomain.com:443 -chainCAstore "org.openssl.winstore://

[Lipovlan]

From the error message I can tell that no certificate was sent to the server at all. Otherwise you would get a 403 Forbidden if the certificate were a wrong one.

If your key is an RSA key and you have it in the CryptoAPI:NG store my provider may help you.

If you need just to solve the connection problem and do not need to use the winstore try my example client, I’ve used it to debug a very similar scenario: https://github.com/Lipovlan/cng-openssl-provider/blob/master/client/client.c

[ToniA]

Well, I was hoping I was just unable to find the right combination of command line parameters to the openssl s_client command. I have the smartcard in the reader, the Windows certificate manager can see it, I have the PIN code, and cURL works just fine.

The specific use case is troubleshooting strange problems with mTLS autentication when using X.509 smart card certificates to authenticate with Azure Application Gateway SKU v2. I'm not sure if I should blame the cards (I know for sure some of them are older revision), or the Windows card reader driver (there are various versions of 'Alcorlink USB Smart Card Reader', packaged by Lenovo and Fujitsu for their laptops with internal card reader slot). This problem seems to haunt only certain smart card / laptop combinations, like I have never had any problems with any card on my own laptop...

[hlandau]

The OpenSSL winstore support is for root certificate stores only at this time. You cannot use it to use a personal or client certificate.

[ToniA]

Thank you, this at least answers my question. Any plans to support it in the near future?