Certificate verification fails if the certificate being verified does not contain the relevant extensions

[kajinamit]

Problem description

I'm trying to verify the VCEK certificate published by AMD. According to the document VCEK is supposed to be verified by ARK (root certificate) and ASK (intermediate certificate).
However verification consistently fails because of Certificate is missing required extension.

>>> import datetime
>>>
>>> from cryptography import x509
>>> from cryptography.x509 import verification
>>>
>>> with open('certs/vcek.pem', 'rb') as f:
...     vcek = x509.load_pem_x509_certificate(f.read())
...
>>> with open('certs/ark.pem', 'rb') as f:
...     ark = x509.load_pem_x509_certificates(f.read())
...
>>> with open('certs/ask.pem', 'rb') as f:
...     ask = x509.load_pem_x509_certificates(f.read())
...
>>> store = verification.Store(ark)
>>> builder = verification.PolicyBuilder().store(store)
>>> builder = builder.time(datetime.datetime.now())
>>> verifier = builder.build_client_verifier()
>>> chain = verifier.verify(vcek, ask)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
cryptography.hazmat.bindings._rust.x509.VerificationError: validation failed: Other("Certificate is missing required extension")

I suspect "the missing required extension" is Authority Key Identifier (or Subject Key Identifier) . RFC5280 states that To facilitate certification path construction, this extension MUST appear in all conforming CA certificates while it also states that Conforming CAs MUST mark this extension as non-critical. I'm wondering if it makes sense that cryptography would ignore missing Subject Key Identifier field, if the field is supposed to be always non-critical.

Versions

• Python 3.10.12 (built-in version in Ubuntu 22.04)
• cryptography 43.0.0.dev1 (hash: ee4b371 )
• pip 22.0.2
• setuptools 59.6.0

Certificate contents

certs/vcek.pem

-----BEGIN CERTIFICATE-----
MIIFTTCCAvygAwIBAgIBADBGBgkqhkiG9w0BAQowOaAPMA0GCWCGSAFlAwQCAgUA
oRwwGgYJKoZIhvcNAQEIMA0GCWCGSAFlAwQCAgUAogMCATCjAwIBATB7MRQwEgYD
VQQLDAtFbmdpbmVlcmluZzELMAkGA1UEBhMCVVMxFDASBgNVBAcMC1NhbnRhIENs
YXJhMQswCQYDVQQIDAJDQTEfMB0GA1UECgwWQWR2YW5jZWQgTWljcm8gRGV2aWNl
czESMBAGA1UEAwwJU0VWLU1pbGFuMB4XDTI0MDExNTA2MTUxMFoXDTMxMDExNTA2
MTUxMFowejEUMBIGA1UECwwLRW5naW5lZXJpbmcxCzAJBgNVBAYTAlVTMRQwEgYD
VQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExHzAdBgNVBAoMFkFkdmFuY2Vk
IE1pY3JvIERldmljZXMxETAPBgNVBAMMCFNFVi1WQ0VLMHYwEAYHKoZIzj0CAQYF
K4EEACIDYgAEtPdxxQ2pW3rYbNncrk9DPG7iJ+9Gj90i71F/oE3FiCr3l6rgnKKv
zzEZVfQayvd3YbI+eiOSgBepoZoPftZf1Eb/eTWW4irg1QJYynmdmSkZN9v9g5oc
+q1e+rcFJ+C5o4IBFzCCARMwEAYJKwYBBAGceAEBBAMCAQAwFwYJKwYBBAGceAEC
BAoWCE1pbGFuLUIwMBEGCisGAQQBnHgBAwEEAwIBAjARBgorBgEEAZx4AQMCBAMC
AQAwEQYKKwYBBAGceAEDBAQDAgEAMBEGCisGAQQBnHgBAwUEAwIBADARBgorBgEE
AZx4AQMGBAMCAQAwEQYKKwYBBAGceAEDBwQDAgEAMBEGCisGAQQBnHgBAwMEAwIB
BjASBgorBgEEAZx4AQMIBAQCAgDRME0GCSsGAQQBnHgBBARAdC0UfRi6ZfCRPZ5W
FZYtt1vaJ1jr+mPf64EvkhO/TvZnzbJVsATWTiefZX5jIyj6ZBveaOvAzFZp8nnK
F8ip/DBGBgkqhkiG9w0BAQowOaAPMA0GCWCGSAFlAwQCAgUAoRwwGgYJKoZIhvcN
AQEIMA0GCWCGSAFlAwQCAgUAogMCATCjAwIBAQOCAgEAKOydNduSgaavjk960GC9
o9vcnTbbjE9dLtdxZ43W/YpcKcgRaUlGT/XYpOWxnsDXpHwNWjN6WcJwUukwa0cN
QOeud6WwZvLj2rDbus/olwcLuPwEZ1apXW8WPBOtxRuBxoaT6FjSTyDw6BCd7kpb
HA494I9jhEJ7zJvtCwFz6niCaouoAtZaU0TXGBvAcIJlr7gdfXalqUip1cr1D/MU
AsXr97dm1U+n8ZCYMqcM48RKZpu/snCX4tZAzo8jAtxlnDPaKzs1HnswiSR7sik/
8SJFsNv0Cn+jWILe8Q6R3EDNRrNJG6ha9ML38GZWONiX1hhWs3YmBLy7IyWCFGS5
B2r7C0WGCeXOOnUMsNN74tblNxIcVeMXDzAYNTfQcB7GjDWDmj6aOVfyivKBA3T9
pqbGF/gH/J8HPSeMnRFvAxBvg4swxCIxCTppCSiKR1o5WZK+jciO75kB+Jx+EfSB
KkIL++n8LCSWbWbj74bo1kAVd+7sB7ox7cMivBNSkJHuYIEtdeC9cRgNPCs4suQL
Y59z4mkNpWQP4GcwFh6Kg0wLS5p6e20r6ldv8bMsP9SpwpGQc3zblLlOIaUYswYk
Uq12onGiXyfPfRlO2CFgHa0vS2mFEayccKTlJmP+5MDdPN+J8BnGKVRPCb7XtRpq
bihY2eof6D+KAvzzwuI43PE=
-----END CERTIFICATE-----

certs/ask.pem

-----BEGIN CERTIFICATE-----
MIIGiTCCBDigAwIBAgIDAQABMEYGCSqGSIb3DQEBCjA5oA8wDQYJYIZIAWUDBAIC
BQChHDAaBgkqhkiG9w0BAQgwDQYJYIZIAWUDBAICBQCiAwIBMKMDAgEBMHsxFDAS
BgNVBAsMC0VuZ2luZWVyaW5nMQswCQYDVQQGEwJVUzEUMBIGA1UEBwwLU2FudGEg
Q2xhcmExCzAJBgNVBAgMAkNBMR8wHQYDVQQKDBZBZHZhbmNlZCBNaWNybyBEZXZp
Y2VzMRIwEAYDVQQDDAlBUkstTWlsYW4wHhcNMjAxMDIyMTgyNDIwWhcNNDUxMDIy
MTgyNDIwWjB7MRQwEgYDVQQLDAtFbmdpbmVlcmluZzELMAkGA1UEBhMCVVMxFDAS
BgNVBAcMC1NhbnRhIENsYXJhMQswCQYDVQQIDAJDQTEfMB0GA1UECgwWQWR2YW5j
ZWQgTWljcm8gRGV2aWNlczESMBAGA1UEAwwJU0VWLU1pbGFuMIICIjANBgkqhkiG
9w0BAQEFAAOCAg8AMIICCgKCAgEAnU2drrNTfbhNQIllf+W2y+ROCbSzId1aKZft
2T9zjZQOzjGccl17i1mIKWl7NTcB0VYXt3JxZSzOZjsjLNVAEN2MGj9TiedL+Qew
KZX0JmQEuYjm+WKksLtxgdLp9E7EZNwNDqV1r0qRP5tB8OWkyQbIdLeu4aCz7j/S
l1FkBytev9sbFGzt7cwnjzi9m7noqsk+uRVBp3+In35QPdcj8YflEmnHBNvuUDJh
LCJMW8KOjP6++Phbs3iCitJcANEtW4qTNFoKW3CHlbcSCjTM8KsNbUx3A8ek5EVL
jZWH1pt9E3TfpR6XyfQKnY6kl5aEIPwdW3eFYaqCFPrIo9pQT6WuDSP4JCYJbZne
KKIbZjzXkJt3NQG32EukYImBb9SCkm9+fS5LZFg9ojzubMX3+NkBoSXI7OPvnHMx
jup9mw5se6QUV7GqpCA2TNypolmuQ+cAaxV7JqHE8dl9pWf+Y3arb+9iiFCwFt4l
AlJw5D0CTRTC1Y5YWFDBCrA/vGnmTnqG8C+jjUAS7cjjR8q4OPhyDmJRPnaC/ZG5
uP0K0z6GoO/3uen9wqshCuHegLTpOeHEJRKrQFr4PVIwVOB0+ebO5FgoyOw43nyF
D5UKBDxEB4BKo/0uAiKHLRvvgLbORbU8KARIs1EoqEjmF8UtrmQWV2hUjwzqwvHF
ei8rPxMCAwEAAaOBozCBoDAdBgNVHQ4EFgQUO8ZuGCrD/T1iZEib47dHLLT8v/gw
HwYDVR0jBBgwFoAUhawa0UP3yKxV1MUdQUir1XhK1FMwEgYDVR0TAQH/BAgwBgEB
/wIBADAOBgNVHQ8BAf8EBAMCAQQwOgYDVR0fBDMwMTAvoC2gK4YpaHR0cHM6Ly9r
ZHNpbnRmLmFtZC5jb20vdmNlay92MS9NaWxhbi9jcmwwRgYJKoZIhvcNAQEKMDmg
DzANBglghkgBZQMEAgIFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgIFAKID
AgEwowMCAQEDggIBAIgeUQScAf3lDYqgWU1VtlDbmIN8S2dC5kmQzsZ/HtAjQnLE
PI1jh3gJbLxL6gf3K8jxctzOWnkYcbdfMOOr28KT35IaAR20rekKRFptTHhe+DFr
3AFzZLDD7cWK29/GpPitPJDKCvI7A4Ug06rk7J0zBe1fz/qe4i2/F12rvfwCGYhc
RxPy7QF3q8fR6GCJdB1UQ5SlwCjFxD4uezURztIlIAjMkt7DFvKRh+2zK+5plVGG
FsjDJtMz2ud9y0pvOE4j3dH5IW9jGxaSGStqNrabnnpF236ETr1/a43b8FFKL5QN
mt8Vr9xnXRpznqCRvqjr+kVrb6dlfuTlliXeQTMlBoRWFJORL8AcBJxGZ4K2mXft
l1jU5TLeh5KXL9NW7a/qAOIUs2FiOhqrtzAhJRg9Ij8QkQ9Pk+cKGzw6El3T3kFr
Eg6zkxmvMuabZOsdKfRkWfhH2ZKcTlDfmH1H0zq0Q2bG3uvaVdiCtFY1LlWyB38J
S2fNsR/Py6t5brEJCFNvzaDky6KeC4ion/cVgUai7zzS3bGQWzKDKU35SqNU2WkP
I8xCZ00WtIiKKFnXWUQxvlKmmgZBIYPe01zD0N8atFxmWiSnfJl690B9rJpNR/fI
ajxCW3Seiws6r1Zm+tCuVbMiNtpS9ThjNX4uve5thyfE2DgoxRFvY1CsoF5M
-----END CERTIFICATE-----

certs/ark.pem

-----BEGIN CERTIFICATE-----
MIIGYzCCBBKgAwIBAgIDAQAAMEYGCSqGSIb3DQEBCjA5oA8wDQYJYIZIAWUDBAIC
BQChHDAaBgkqhkiG9w0BAQgwDQYJYIZIAWUDBAICBQCiAwIBMKMDAgEBMHsxFDAS
BgNVBAsMC0VuZ2luZWVyaW5nMQswCQYDVQQGEwJVUzEUMBIGA1UEBwwLU2FudGEg
Q2xhcmExCzAJBgNVBAgMAkNBMR8wHQYDVQQKDBZBZHZhbmNlZCBNaWNybyBEZXZp
Y2VzMRIwEAYDVQQDDAlBUkstTWlsYW4wHhcNMjAxMDIyMTcyMzA1WhcNNDUxMDIy
MTcyMzA1WjB7MRQwEgYDVQQLDAtFbmdpbmVlcmluZzELMAkGA1UEBhMCVVMxFDAS
BgNVBAcMC1NhbnRhIENsYXJhMQswCQYDVQQIDAJDQTEfMB0GA1UECgwWQWR2YW5j
ZWQgTWljcm8gRGV2aWNlczESMBAGA1UEAwwJQVJLLU1pbGFuMIICIjANBgkqhkiG
9w0BAQEFAAOCAg8AMIICCgKCAgEA0Ld52RJOdeiJlqK2JdsVmD7FktuotWwX1fNg
W41XY9Xz1HEhSUmhLz9Cu9DHRlvgJSNxbeYYsnJfvyjx1MfU0V5tkKiU1EesNFta
1kTA0szNisdYc9isqk7mXT5+KfGRbfc4V/9zRIcE8jlHN61S1ju8X93+6dxDUrG2
SzxqJ4BhqyYmUDruPXJSX4vUc01P7j98MpqOS95rORdGHeI52Naz5m2B+O+vjsC0
60d37jY9LFeuOP4Meri8qgfi2S5kKqg/aF6aPtuAZQVR7u3KFYXP59XmJgtcog05
gmI0T/OitLhuzVvpZcLph0odh/1IPXqx3+MnjD97A7fXpqGd/y8KxX7jksTEzAOg
bKAeam3lm+3yKIcTYMlsRMXPcjNbIvmsBykD//xSniusuHBkgnlENEWx1UcbQQrs
+gVDkuVPhsnzIRNgYvM48Y+7LGiJYnrmE8xcrexekBxrva2V9TJQqnN3Q53kt5vi
Qi3+gCfmkwC0F0tirIZbLkXPrPwzZ0M9eNxhIySb2npJfgnqz55I0u33wh4r0ZNQ
eTGfw03MBUtyuzGesGkcw+loqMaq1qR4tjGbPYxCvpCq7+OgpCCoMNit2uLo9M18
fHz10lOMT8nWAUvRZFzteXCm+7PHdYPlmQwUw3LvenJ/ILXoQPHfbkH0CyPfhl1j
WhJFZasCAwEAAaN+MHwwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBSFrBrRQ/fI
rFXUxR1BSKvVeErUUzAPBgNVHRMBAf8EBTADAQH/MDoGA1UdHwQzMDEwL6AtoCuG
KWh0dHBzOi8va2RzaW50Zi5hbWQuY29tL3ZjZWsvdjEvTWlsYW4vY3JsMEYGCSqG
SIb3DQEBCjA5oA8wDQYJYIZIAWUDBAICBQChHDAaBgkqhkiG9w0BAQgwDQYJYIZI
AWUDBAICBQCiAwIBMKMDAgEBA4ICAQC6m0kDp6zv4Ojfgy+zleehsx6ol0ocgVel
ETobpx+EuCsqVFRPK1jZ1sp/lyd9+0fQ0r66n7kagRk4Ca39g66WGTJMeJdqYriw
STjjDCKVPSesWXYPVAyDhmP5n2v+BYipZWhpvqpaiO+EGK5IBP+578QeW/sSokrK
dHaLAxG2LhZxj9aF73fqC7OAJZ5aPonw4RE299FVarh1Tx2eT3wSgkDgutCTB1Yq
zT5DuwvAe+co2CIVIzMDamYuSFjPN0BCgojl7V+bTou7dMsqIu/TW/rPCX9/EUcp
KGKqPQ3P+N9r1hjEFY1plBg93t53OOo49GNI+V1zvXPLI6xIFVsh+mto2RtgEX/e
pmMKTNN6psW88qg7c1hTWtN6MbRuQ0vm+O+/2tKBF2h8THb94OvvHHoFDpbCELlq
HnIYhxy0YKXGyaW1NjfULxrrmxVW4wcn5E8GddmvNa6yYm8scJagEi13mhGu4Jqh
3QU3sf8iUSUr09xQDwHtOQUVIqx4maBZPBtSMf+qUDtjXSSq8lfWcd8bLr9mdsUn
JZJ0+tuPMKmBnSH860llKk+VpVQsgqbzDIvOLvD6W1Umq25boxCYJ+TuBoa4s+HH
CViAvgT9kf/rBq1d+ivj6skkHxuzcxbk1xv6ZGxrteJxVH7KlX7YRdZ6eARKwLe4
AFZEAwoKCQ==
-----END CERTIFICATE-----

[kajinamit]

The certificate can be verified by openssl

# openssl verify -CAfile certs/ark.pem -untrusted certs/ask.pem certs/vcek.pem
certs/vcek.pem: OK

or pyOpenSSL

>>> from OpenSSL import crypto
>>> with open('certs/vcek.pem', 'rb') as f:
...     vcek = crypto.load_certificate(crypto.FILETYPE_PEM, f.read())
...
>>> with open('certs/ark.pem', 'rb') as f:
...     ark = crypto.load_certificate(crypto.FILETYPE_PEM, f.read())
...
>>> with open('certs/ask.pem', 'rb') as f:
...     ask = crypto.load_certificate(crypto.FILETYPE_PEM, f.read())
...
>>> store = crypto.X509Store()
>>> store.add_cert(ark)
>>> store.add_cert(ask)
>>> ctx = crypto.X509StoreContext(store, vcek)
>>> ctx.verify_certificate()
>>>

[kajinamit]

OK it turned out the verification fails even with openssl when strict mode is enabled ...

# openssl verify -CAfile certs/ark.pem -untrusted certs/ask.pem -x509_strict certs/vcek.pem
OU = Engineering, C = US, L = Santa Clara, ST = CA, O = Advanced Micro Devices, CN = SEV-VCEK
error 85 at 0 depth lookup: Missing Authority Key Identifier
error certs/vcek.pem: verification failed

[kajinamit]

Since the issue is also detected by openssl, I've reported the issue in virtee/snpguest#57 (comment) .
We have checked a few certificates available in web but some of these do not contain these fields, actually.

[reaperhulk]

Our verifier currently is based on the WebPKI, which requires AKIs. This doesn't prohibit us having alternate verification options in the future (e.g., our client verifier), although some API discussion would be needed to determine what makes sense.

One concern I have is that it's not clear to me that AMD did the diligence to understand X.509 and generate proper certificates as opposed to just doing some quick empirical checks against existing implementations.

Separately, our error message would be more useful if it explained what required extensions were missing.

cc @woodruffw for when he's back from vacation 😄

[woodruffw]

Thanks for the ping @reaperhulk!

100% agreed about improving the error message; I can take a poke at that sometime in the coming days.

See also #10276 (comment) for a similar request (Intel SGX instead of AMD SEV, but also caused by profile variants).

[woodruffw]

Looping back: #11162 improved the extension error messages here.