PEM Certificate ASN.1 Issue: exception error: no match of right hand side value

DanielSchutte · June 23, 2024, 3:05pm

Good afternoon,

I hope someone can assist me. I have a certificate in PEM format that can be validated by various online decoders as well as OpenSSL. (The cert I am testing with is added below)

I have seen a similar error saying that the initial 24 bytes is an issue but even after removing it, still does not seem to resolve. If anyone can assist or has any suggestions it would be welcome.

The Pem decode works perfectly

[PemEntry] = public_key:pem_decode(PEM).
[{'PrivateKeyInfo',<<48,130,4,75,48,130,3,51,160,3,2,1,2,
                     2,9,0,218,186,14,186,109,241,32,121,
                     48,13,...>>,
                   not_encrypted}]

but in the following the following error occurs

public_key:pem_entry_decode(PEMEntry).

** exception error: no match of right hand side value {error,{asn1,{{wrong_tag,{{expected,2},
{got,16,
{16,
[{131072,[{2,<<2>>}]},
{2,<<0,218,186,14,186,109,241,32,121>>},
{16,[{6,<<42,134,72,134,247,13,1,...>>},{5,<<>>}]},
{16,
[{17,[{16,[{6,<<...>>},{19,...}]}]},
{17,[{16,[{6,...},{...}]}]},
{17,[{16,[{...}|...]}]},
{17,[{16,[...]}]},
{17,[{16,...}]},
{17,[{...}]}]},
{16,[{23,<<"171116140507Z">>},{23,<<"310726140507Z">>}]},
{16,
[{17,[{16,[{...}|...]}]},
{17,[{16,[...]}]},
{17,[{16,...}]},
{17,[{...}]},
{17,[...]},
{17,...}]},
{16,[{16,[{6,<<...>>},{5,...}]},{3,<<0,48,...>>}]},
{131075,[{16,[{16,...},{...}|...]}]}]}}}},
[{'PKCS-FRAME',match_tags,2,
[{file,"../src/PKCS-FRAME.erl"},{line,3223}]},
{'PKCS-FRAME',decode_integer,2,
[{file,"../src/PKCS-FRAME.erl"},{line,3042}]},
{'PKCS-FRAME',dec_OneAsymmetricKey,2,
[{file,"../src/PKCS-FRAME.erl"},{line,1790}]},
{'PKCS-FRAME',decode,2,

starbelly · June 23, 2024, 3:40pm

Maybe it’s how you pasted your key (which I hope is not a key utilized for anything and just for testing! ), but openssl chokes with the same error trying to decode.

7991824384:error:0D0680A8:asn1 encoding routines:asn1_check_tlen:wrong tag:crypto/asn1/tasn_dec.c:1149:

DanielSchutte · June 23, 2024, 4:21pm

Let me attach it in a file, and definitely for testing.

openssl x509 -in cert.crt -text -noout

WIth this I could view the certificate without any issues.

and could even do the transform to try and make sense of the tags with this:

openssl x509 -in cert.crt -outform der | openssl asn1parse -inform der

(Attachment cert.crt is missing)

starbelly · June 23, 2024, 4:32pm

What you pasted is not a private key, it is a certificate

DanielSchutte · June 23, 2024, 4:37pm

Attaching the key in an attachment (extension just changed so mailing list can accept it). It is a PEM cert

(Attachment cert.jpg is missing)

DanielSchutte · June 23, 2024, 4:57pm

Apologies yes - have tried a few things to see if it would make a difference.

openssl x509 -in cert.crt -text -noout

WIth this I could view the certificate without any issues.

and could even do the transform to try and make sense of the tags with this:

openssl x509 -in cert.crt -outform der | openssl asn1parse -inform der

starbelly · June 23, 2024, 5:11pm

This works fine for me. I wonder, similar to what you pasted, if you were reading in the key vs your cert, etc.

[{'Certificate',<<48,130,4,75,48,130,3,51,160,3,2,1,2,2,9,
                  0,218,186,14,186,109,241,32,121,48,13,
                  ...>>,
                not_encrypted}]
2> [Entry] = public_key:pem_decode(Pem).
[{'Certificate',<<48,130,4,75,48,130,3,51,160,3,2,1,2,2,9,
                  0,218,186,14,186,109,241,32,121,48,13,
                  ...>>,
                not_encrypted}]
3> public_key:pem_entry_decode(Entry).
{'Certificate',{'TBSCertificate',v3,15760926039807697017,
                                 {'AlgorithmIdentifier',{1,2,840,113549,1,1,11},<<5,0>>},
...