Exception when pubkey algorithm isn't supported confuses cert type and cert algorithm

[danielbprice]

Version(s)

v1.4.2 and v2.0.0-M10

Which components

leshan-core

Tested With

No response

What happened

When I start the server with a CA certificate which uses an RSA public key certificate, the code produces the exception:

java.security.cert.CertificateException: X.509 algorithm is not supported, Only EC algorithm is supported

The code looks like this, from org.eclipse.leshan.core.util.SecurityUtil:

// we support only EC algorithm
if (!"EC".equals(certificate.getPublicKey().getAlgorithm())) {
    throw new CertificateException(String.format(
           "%s algorithm is not supported, Only EC algorithm is supported", certificate.getType()));
//                                                                          ^^^^^^^^^^^^^^^^^^^^^
}

I believe this (and similar code nearby in the same file) should instead be:

// we support only EC algorithm
if (!"EC".equals(certificate.getPublicKey().getAlgorithm())) {
    throw new CertificateException(String.format(
            "%s algorithm is not supported, Only EC algorithm is supported", certificate.getPublicKey().getAlgorithm()));
//                                                                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
}

How to reproduce

Create a CA certificate with an unsupported algorithm (mine looks like this):

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            <redacted>
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = <redacted>
        Validity
            Not Before: May 29 07:17:02 2020 GMT
            Not After : May 30 03:17:32 2023 GMT
        Subject: CN = <redacted>
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)

And try to use that with Leshan.

Relevant Output

No response

[sbernard31]

That makes sense!
Thx for reporting this 🙏

[sbernard31]

This should be fixed in :

• master commit 14b6f5c
• 1.x commit c77cee9

Thx again @danielbprice 😉