Error while register app via web interface

đŸ’» Development
1

Hallo, my name is Wolfgang and i’ve created an app.
Yesterday i got my app successfully certificated and now i tried to publish it in nextcloud app store via web interface, but there is the error

Signature is invalid: [(‘rsa routines’, ‘’, ‘invalid padding’), (‘rsa routines’, ‘’, ‘padding check failed’), (‘Provider routines’, ‘’, ‘RSA lib’)]

i followed the introductions and pasted the content of the crt file into the first field.
then i used the suggested code

> echo -n "APP_ID" | openssl dgst -sha512 -sign ~/.nextcloud/certificates/APP_ID.key | openssl base64

and pasted the output into second field

I also tried signature and certificate from my signature.json with no success.
I’ve also tried the REST Api with the same error and found no solution.
I am thankful for any hint.

2

Hello Wolfgang,

Did you actually replace APP_ID with your app’s id here?

If that does not help, you can manually check the app id.

Please do not paste here the signature as requested by echo -n "APP_ID" | openssl dgst -sha512 -sign ~/.nextcloud/certificates/APP_ID.key | openssl base64 or typed into the form (this is confidential). However, can you paste the app id (like cookbook in my case) to simplify discussions?

Christian

3

Hello Christian,

thank you for answering. In my case the command was

echo -n “logcleaner” | openssl dgst -sha512 -sign ~/.nextcloud/certificates/logcleaner.key | openssl base64

My development environment is a docker nextcloud. Before i created the csr i copied my app folder to bak_logcleaner and deleted in the original logcleaner all unwanted and unneeded files. Then there was a strange behaviour. The command within the logcleaner folder

openssl req -nodes -newkey rsa:4096 -keyout logcleaner.key -out logcleaner.csr -subj “/CN=logcleaner”

stored the csr and key file within the bak_logcleaner folder. Maybe here is my mistake and the generated files are not for the logcleaner but for the bak_logcleaner with the wrong files amount.

4

The openssl req [...] -out foo command will create a file foo in the current working directory. The CSR you create with the command is for the app with the id logcleaner (from -subj /CN=logcleaner).

However, why do you regenerate a CSR? You published already one a week ago and got the corresponding certificate from the PKI OPs. Is the certificate to be revoked due to key disclosure?

I have a wild guess what happened. Did you create a CSR, filed this and then recreated a new CSR (with a new key file) using openssl req -new? If yes, do you by chance have a copy of the original key file?

If this guess was wrong, we can locally check the signature to see if it is created correctly. (Hint for myself: [1] [2])

FYI: There is a tutorial at readthedocs. Did you follow that one? Just for information. Please do not plainly execute new commands especially regarding the certificates as this might overwrite data.

5

yes, but it was stored into bak_logcleaner. I don’t know why.

my steps from above were before i sent the pull request. i followed these steps: How to get your app signed to generate csr and private key and posted the csr as pull request.

the crt, csr and key i moved into a new folder /Users/example to run the command

./occ integrity:sign-app --privateKey=/Users/lukasreschke/contacts.key --certificate=/Users/lukasreschke/CA/contacts.crt --path=/Users/lukasreschke/Programming/contacts

setting the folder from above and changing contacts to logcleaner and that generates signature.json file within the appinfo folder.

do you think it’ll be the best to delete all generated files and begin procedure from step 0 and send a new pull request? maybe this is the quickest way

6

Well, I suspect you were in that folder (intentionally or not).

Well this is about code signing. This is a file that the NC server on the users’ instances will look at if something in the installation process was broken. This is not about the app store (except that the same keys are used for code signing and app store authentication).

OK, then these files are the important ones. No other certificate CSR or key do matter.

I would first create the logcleaner app in the app store. Then you claimed the app name. Uploading can be done later. So, let’s focus on this.

The certificate is the file /Users/example/<name of certificate>.crt (according to your claims). You upload its content in the first field of the app store. The token challenge (second field) is then

echo -n logcleaner | openssl dgst -sha512 -sign /Users/example/<key file name>.key | openssl base64

This can be done as long as the app is not published yet. Otherwise it is a hell of work (I had to do this once) as all releases get invalidated. So, best is to keep your stuff in a safe place! (Trust me in this :frowning_face:)

7

I did this on App registrieren (exactly the same I tried yesterday) and the result is the same error:

error
error684×280 26.7 KB

I took a look into the signature.json and compared “certificate”, what is the same content as my crt file, but “signature” is different to my echo output.

8

The signature.json is of no interest here. It is only for signing the code as I wrote earlier.

You could check if the certificate and the private key match up. To do this, compare the outputs of the following commands

$ openssl rsa -noout -modulus -in <FILENAME_OF_KEY_FILE> | openssl base64
$ curl https://raw.githubusercontent.com/nextcloud/app-certificate-requests/refs/heads/master/logcleaner/logcleaner.crt | openssl x509 -modulus -noout | openssl base64

They should both be

TW9kdWx1cz05RTUxMEFBRDVEODA2MzJGMTgyRDlEQkVDNTBGNEVEOUQ1MTlCMUU0
NzlCODZGMzc2QzFDMzlDQTA4ODIwMzRFQ0M5RTQ3NzQxQjlDQTUzRjgwM0ZDNkFG
NTJBMkYwOTI3MDA0RDEyN0E5RTEzMUJBQkU4NzIyRUE2MjBBQTZBOThCNTQ0RTNC
NUI1QjNEQzcyN0VGNEYyMDMzMkMzOTQ4OTlGMTk1RUZGRjQ1N0Y3QUY3QTE0MzZB
RTg5QkRGNTI5QzJGMzk0NjU2MUJCMTMyRUMyQjk3RDUxRTg2RUI1Q0FCQ0FCQjI5
Nzk2MTY2M0UwQzM3RkZBNDI3RDM2Mjg1RkQ5RDQzQzlFMTQzQjBCNDVBQkY4NjdE
MEI4MTA0RkUwMkU1OTM4Qzc4RjcyRUNDRjM4MjVEODQ5MDdEMjIyRTA5QTlFNDk3
MzFDMkYzQTRDM0NCQThFOUQ4RkRCNDgyNUExM0VBMTA3NEQ2OTgwQzgyODVBQjM5
RjQwRjBDNzBGNjJGOUQ3NDAwOTg4ODIzMzYyOTY2N0IxREJBOTZGNjFFQTRBODVB
RUJFRTdEMzYyQjNDNjU0N0M0NDdBNTgyM0FDQjEwMTNCMEVEQUE1NjBCOTAwOUFF
OTBGQzU5MjA3NTY4NkIwNUMyNkQ2OUIzOTZERjY1NjVBMjU0OUJCRUQxMDZFRDI2
RUYyRUNFNjE0MTY5NTYzQ0UwQUI3MjRCOTM3OUE5MEMyQzk2QTUxQjQ2OEY4N0FC
RDFDRENENDk2Q0QzRjM3MjIzQTk1RDkzOUI4NzgzNEQ2RjFERDk5OUZEQUZCRTM1
RTQzMDM3MEJCQTcyNDA2ODQwMDUyNzg5REJBRjkyMTY5MzQ5ODU4QzI2MzJCRDBE
RjE2MkE1MTEwMzYzRkY4MDRGOTU0NDQ4MzRCMEFGMEM2MkNDNENGQjkxQ0Y1Mzg2
NDkzOUU3MkNBNzRCOEEwQkE2RURCQzc2REM4MUNDQkMxMUQ2M0YwM0NBQjRDRUI5
RUVCNUZDMEE2MEVDRTZGOUNBNDgyRDJFNEQ1REE4QzFFRTNDNjlDN0E2RTZFNTEw
N0QxNDI3ODQ2Qjk4OEMyMDdGMDZDOTNDNDM2RDU0OEE5RDhGNDc0QTRBQTQ5NkZD
RjVDOTI5MzQwMTc2NkZCN0VGRkU3NDk0Q0MzOUFERDJEREI0NDdGMzRBOTE3NkM2
NTE2Qjk0NDBDNTM3REMzMERBM0YxNDFBRjU0QzZGNUM3N0Y2RUExQjk4NjVEM0RC
QUEyQkY4NzQzNDQzQzZGM0UwRkI1QTA0MkRBRkM4ODYxRjIwRkIwRERCMDY5N0Q3
MkNGQzQ5NTJDM0RCMTFGRTE0RDE0QzEzCg==

Additionally, you could verify the signature you created. First, you have to extract the public key by means of the following (replace /tmp/nc.pub.pem by any path you like):

curl https://raw.githubusercontent.com/nextcloud/app-certificate-requests/refs/heads/master/logcleaner/logcleaner.crt | openssl x509 -pubkey -noout > /tmp/nc.pub.pem

To check the generated signature, you have to write it into a file of your choosing. For example

echo -n logcleaner | openssl dgst -sha512 -sign /Users/example/<key file name>.key > /tmp/nc.sign

Finally, the check is done by

echo -n logcleaner | openssl dgst -sha512 -verify /tmp/nc.pub.pem -signature /tmp/nc.sign

It should output Verified OK.

You can also sign an arbitrary text (just tell me the text) and I can test if I can check the signature here just to make sure, everything is correct.

9

all steps before this last command were ok, but running this last command it says Verification failure:

Verification failure
40D7170CFA770000:error:0200008A:rsa routines:RSA_padding_check_PKCS
1_type_1:invalid padding:
/crypto/rsa/rsa_pk1.c:75:
40D7170CFA770000:error:02000072:rsa routines:rsa_ossl_public_decryp
t:padding check failed:
/crypto/rsa/rsa_ossl.c:598:
40D7170CFA770000:error:1C880004:Provider routines:rsa_verify:RSA li
b:
/providers/implementations/signature/rsa_sig.c:774:

10

Which version of openssl are you using?

11

my openssl version is

OpenSSL 3.0.15 3 Sep 2024 (Library: OpenSSL 3.0.15 3 Sep 2024)

12

I am running out of ideas to be honest. You could try if the public key is readable:

openssl rsa -pubin -in /tmp/nc.pub.pem -noout -text

I read that some openssl versions do have problems with no-LF endings. Can you check your public key with

cat -v /tmp/nc.pub.pem

if there are any ^M chars (or others with ^)?

13

There is no ^ sign. only characters, numbers, + / and = signs

the first command creates an output

Public-Key: (4096 bit)
Modulus:
    00
and so on and ends with
Exponent: 65537 (0x10001)
14

OK, honestly, I am struck.

Either you somehow messed with the various files and are not able to see clearly anymore (at least I am typically at some point of debugging no longer able to do stuff correctly). Then, you might have combined wrong CSR/key/CERT files. Can happen but yeah, you said you double checked it.

Then, there could be some isse with the openssl library in some way. You could replace it easily when you have docker available. Then any ubuntu or whatever image should be able to install openssl. There is a good chance you get another version.

I tried to do the steps above with the cookbook keys and this worked as I expect it:

# Do I have the latest version of the certificate here?
$ diff -s <(openssl x509 -noout -modulus -in .nextcloud/certificates/cookbook/cookbook.crt ) <(openssl rsa -noout -modulus < .nextcloud/certificates/cookbook/cookbook.key )
Dateien /dev/fd/63 und /dev/fd/62 sind identisch.

# Extract public key in /tmp/nc.pub.pem
$ openssl x509 -noout -pubkey < .nextcloud/certificates/cookbook/cookbook.crt > /tmp/nc.pub.pem

# Create a dummy signature
$ echo -n abc | openssl dgst -sha512 -sign .nextcloud/certificates/cookbook/cookbook.key | openssl base64
duPuU2rAqlXa7hGtB8zxjMKkRo9kSnZRFtetX9dIWODucp5bEFgty2xKRHGNrylD
b3dC8yzeWCHpeIlpNlW8H3UDHOFgIBhdiF1FvOD0EFabMSxoBZ2dctfbzHeu6bGl
+XIXLm43zad7J/H6lV9NesK6HwJUQoBVZ66g7E3nxj/Ui8jveqYzzDj2WJiosXhP
TMLKPcpQqdZlnJPOFDxnyzJt3vzHEE4ptQJHQNn1MZzGT4bUYyrldE8YJ6KLnTzD
WrXbnqwlksf1N+ghZ/A8D33/jwFpzbY4Yd0Mytii7PGObjMd9JvXuxrthLKbu+5k
69iYRbXuGeT2tkiNUvJiC6obgX5XdgFzNMTZ1vpFA7DfKKPjeNGCjgnAwugYiEda
+fBTYOQL+zOtBYrWNwbmyRKseuHlTCMMumPhTp4eUlZ4crr5IdCAKhJzKPqmx6t1
yCtx8VtQV0Dsj/T+4R/HMYAwTWWmodWP3e9042z9ubL/gHMXPRvz6kmhNQOWLhS0
LmFjVzLRvYhlFSsw6a71QcI9rJ607dgqxiygMKxY1Tn6uhIRNqLEmQPPP+WwmWYf
wTyj2rvS0CV3dtmb64gT5XttKIP0Ym/MhJJVcR2OTQ8blEgWiXApSD+fZtfb79tw
Tx21fCkLoT7jKO0XmHbohzoY+yB0pSlVriC5jLh2Um0=
$ echo -n abc | openssl dgst -sha512 -sign .nextcloud/certificates/cookbook/cookbook.key > /tmp/nc.sign

# Test a  valid signature
$ echo -n abc | openssl dgst -sha512 -verify /tmp/nc.pub.pem -signature /tmp/nc.sign 
Verified OK

# Test a failing signature
$ echo -n ac | openssl dgst -sha512 -verify /tmp/nc.pub.pem -signature /tmp/nc.sign 
Verification failure
804B38AEE6700000:error:02000068:rsa routines:ossl_rsa_verify:bad signature:crypto/rsa/rsa_sign.c:442:
804B38AEE6700000:error:1C880004:Provider routines:rsa_verify_directly:RSA lib:providers/implementations/signature/rsa_sig.c:1041:

$ openssl version
OpenSSL 3.4.0 22 Oct 2024 (Library: OpenSSL 3.4.0 22 Oct 2024)

So, long story short: I do not see the roor in your setup. Maybe you try again after a good night of sleep. Eventually test another openssl version. You can try to verify the signature I created if you want (then you know that the openssl works in general). But I am as I said out of (good) ideas.

15

Hey Christian,

thank you for your time and all the ideas and hints. I will not give up and will post my solution if i find out one :wink:

Hab ein schönes Wochenende und Dankeschön

Gruß aus dem hohen Norden
Wolfgang

1 Like
16

Hello Christian,

you were absolutely right - from the beginning: my csr and key files did not match with the crt file

i checked this with the following commands

openssl x509 -noout -modulus -in logcleaner.crt | openssl md5
openssl rsa -noout -modulus -in logcleaner.key | openssl md5
openssl req -noout -modulus -in logcleaner.csr | openssl md5

checksum csr and key matched, but crt was different. So it was clear, what you suspected was right - i used wrong csr and key all the time.
I found the right csr and key files on my system, generated new /tmp/nc.pub.pem and /tmp/nc.sign and the command echo -n logcleaner | openssl dgst -sha512 -verify /tmp/nc.pub.pem -signature /tmp/nc.sign resulted into Verified OK - JIHAA

Now I was able to register my app
success

Thank you very much indeed

Have a nice Weekend
Wolfgang

1 Like
17

Hooray :tada: :100: !

Now, do me a favor and store all valid files in a consistent location permanently (!) and get rid of all invalid files. You got me crazy yesterday :rofl: :stuck_out_tongue_closed_eyes:. I honestly started to mistrust myself.

GrĂŒĂŸe in den Norden aus dem Saarland
Chris