From 2e8f9fe5950b7fcee84023e4a6f367f72e0b3530 Mon Sep 17 00:00:00 2001 From: Andrew Hutchings Date: Wed, 18 Feb 2026 17:58:28 +0000 Subject: [PATCH] Fix SM2 certs to have the correct public key OID OpenSSL 3.5+ handles the OIDs differently. --- certs/sm2/ca-sm2.der | Bin 666 -> 667 bytes certs/sm2/ca-sm2.pem | 32 +++--- certs/sm2/client-sm2.der | Bin 970 -> 973 bytes certs/sm2/client-sm2.pem | 48 ++++----- certs/sm2/fix_sm2_spki.py | 179 ++++++++++++++++++++++++++++++++++ certs/sm2/gen-sm2-certs.sh | 16 +++ certs/sm2/root-sm2.der | Bin 662 -> 663 bytes certs/sm2/root-sm2.pem | 32 +++--- certs/sm2/self-sm2-cert.pem | 34 +++---- certs/sm2/server-sm2-cert.der | Bin 731 -> 733 bytes certs/sm2/server-sm2-cert.pem | 34 +++---- certs/sm2/server-sm2.pem | 66 ++++++------- 12 files changed, 318 insertions(+), 123 deletions(-) create mode 100644 certs/sm2/fix_sm2_spki.py diff --git a/certs/sm2/ca-sm2.der b/certs/sm2/ca-sm2.der index 38fea750d7f4e1b02f153ad5ba10bb7c0e382df5..2b416438642e03c6c37682390f1f2779ab32d144 100644 GIT binary patch delta 134 zcmbQmI-8ZlpowX^K@*eBM2_te=B8$*=27CjMiz#Kh9-s(u0i9PiSjO!r5Q7MqYOmY zIJ6pN&WAEK=}w-&c-(o@&S<8!6+eP@rJp~oI(yg6u&>MiuUA#O`t9@QWnX9M&t_6& m*fZ_3rEu9DCR0nkJ6xIjnIyI`?)%SrUGGzM`fIV5eMbTC3pGao delta 133 zcmbQuI*XOVpowXkK@*epM2_teCPwB)W>Mn2Miz#Kh9-s(u0i9PiSjO!r5Q7MA`OJu z*tOa`&e<|CPM*kk+<8~F$cFbE`+ba(lk^_OvfOlKsXV!V*5vuDE?=J+r);TXQe=26 k{;%EC;FI-gG2J+WGAF+?thD}59AfVe0Ky?H-v9sr diff --git a/certs/sm2/ca-sm2.pem b/certs/sm2/ca-sm2.pem index 5ced06b59d..097a24dad3 100644 --- a/certs/sm2/ca-sm2.pem +++ b/certs/sm2/ca-sm2.pem @@ -5,11 +5,11 @@ Certificate: Signature Algorithm: SM2-with-SM3 Issuer: C=US, ST=Montana, L=Bozeman, O=wolfSSL_SM2, OU=Root-SM2, CN=www.wolfssl.com, emailAddress=info@wolfssl.com Validity - Not Before: Feb 18 14:27:26 2026 GMT - Not After : Nov 14 14:27:26 2028 GMT + Not Before: Feb 18 17:56:57 2026 GMT + Not After : Nov 14 17:56:57 2028 GMT Subject: C=US, ST=Montana, L=Bozeman, O=wolfSSL_sm2, OU=CA-sm2, CN=www.wolfssl.com, emailAddress=info@wolfssl.com, UID=wolfSSL Subject Public Key Info: - Public Key Algorithm: id-ecPublicKey + Public Key Algorithm: sm2 Public-Key: (256 bit) pub: 04:21:92:f7:cb:24:df:64:4d:ba:ab:66:7b:83:75: @@ -29,23 +29,23 @@ Certificate: Digital Signature, Certificate Sign, CRL Sign Signature Algorithm: SM2-with-SM3 Signature Value: - 30:46:02:21:00:ba:6b:14:b0:ef:08:bf:4c:32:63:62:2e:e1: - 5d:04:d9:45:04:79:c9:bf:9a:93:9f:05:44:f5:e6:33:64:b4: - 7e:02:21:00:e3:17:fe:87:35:30:f2:3b:ab:16:2d:5e:30:76: - 42:4e:cc:85:96:b9:2f:af:55:00:a5:4f:43:7c:13:54:3f:4f + 30:46:02:21:00:b2:b9:5b:02:ad:78:f8:52:ba:67:cf:cb:25: + 9b:ba:d9:56:f5:a7:ff:af:25:26:d5:f6:f3:f3:a6:f5:9a:2f: + 9b:02:21:00:bc:96:f3:39:13:76:dc:02:35:39:0e:dc:0a:69: + bf:02:18:b6:01:be:ff:05:d7:2e:f2:7b:67:eb:16:e9:8e:c5 -----BEGIN CERTIFICATE----- -MIICljCCAjugAwIBAgIBATAKBggqgRzPVQGDdTCBlTELMAkGA1UEBhMCVVMxEDAO +MIIClzCCAjygAwIBAgIBATAKBggqgRzPVQGDdTCBlTELMAkGA1UEBhMCVVMxEDAO BgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0JvemVtYW4xFDASBgNVBAoMC3dvbGZT U0xfU00yMREwDwYDVQQLDAhSb290LVNNMjEYMBYGA1UEAwwPd3d3LndvbGZzc2wu -Y29tMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tMB4XDTI2MDIxODE0 -MjcyNloXDTI4MTExNDE0MjcyNlowgawxCzAJBgNVBAYTAlVTMRAwDgYDVQQIDAdN +Y29tMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tMB4XDTI2MDIxODE3 +NTY1N1oXDTI4MTExNDE3NTY1N1owgawxCzAJBgNVBAYTAlVTMRAwDgYDVQQIDAdN b250YW5hMRAwDgYDVQQHDAdCb3plbWFuMRQwEgYDVQQKDAt3b2xmU1NMX3NtMjEP MA0GA1UECwwGQ0Etc20yMRgwFgYDVQQDDA93d3cud29sZnNzbC5jb20xHzAdBgkq hkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20xFzAVBgoJkiaJk/IsZAEBDAd3b2xm -U1NMMFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAEIZL3yyTfZE26q2Z7g3WpKef/ -ZGO21UKAIL3i4gISO460AJUJgMtW7UvKjVfmrgXTdidjcTmJt2nmSICu0alIEqNj -MGEwHQYDVR0OBBYEFEcKSH67AqhaJlcrGal7YYt/XZluMB8GA1UdIwQYMBaAFDQd -eUQVeaGxY5nj7WV8ZImA/7jsMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQD -AgGGMAoGCCqBHM9VAYN1A0kAMEYCIQC6axSw7wi/TDJjYi7hXQTZRQR5yb+ak58F -RPXmM2S0fgIhAOMX/oc1MPI7qxYtXjB2Qk7MhZa5L69VAKVPQ3wTVD9P +U1NMMFowFAYIKoEcz1UBgi0GCCqBHM9VAYItA0IABCGS98sk32RNuqtme4N1qSnn +/2RjttVCgCC94uICEjuOtACVCYDLVu1Lyo1X5q4F03YnY3E5ibdp5kiArtGpSBKj +YzBhMB0GA1UdDgQWBBRHCkh+uwKoWiZXKxmpe2GLf12ZbjAfBgNVHSMEGDAWgBQ0 +HXlEFXmhsWOZ4+1lfGSJgP+47DAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQE +AwIBhjAKBggqgRzPVQGDdQNJADBGAiEAsrlbAq14+FK6Z8/LJZu62Vb1p/+vJSbV +9vPzpvWaL5sCIQC8lvM5E3bcAjU5DtwKab8CGLYBvv8F1y7ye2frFumOxQ== -----END CERTIFICATE----- diff --git a/certs/sm2/client-sm2.der b/certs/sm2/client-sm2.der index e65e62b8d6db1076c051ff536f7b629243693105..be1bbf4f16a0aa0c3e13bb42341b4cd1a5044b50 100644 GIT binary patch delta 211 zcmX@bewJO|po#gUK@)S{0%j&gCMJ>OyQRrp8v_03`2Eif^*j5nU+r>(0T&yGR-?@M zP{!uc$%#yxgQ zVZ>_oWG&_hFHZ&oHzq}fyE7(am`+X97o4#4r9t8KG znMH~78d(?`8k!h_xsw?gxAH_92(z(kwRxPgWn$cXm@$MAs}Ym6nIk;h84O&Q6x0h< zl``KpytcRGtD3!BDXr}Nl`U~E`rX-%>o57r&zZ-hAn|jzkJo|)C;vOCES!~`{pO +""" + +import base64 +import subprocess +import sys +import os +import tempfile + +EC_PUBKEY_OID = bytes([0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01]) +SM2_ALGO_OID = bytes([0x06, 0x08, 0x2a, 0x81, 0x1c, 0xcf, 0x55, 0x01, 0x82, 0x2d]) +SM2_WITH_SM3 = bytes([0x30, 0x0a, 0x06, 0x08, + 0x2a, 0x81, 0x1c, 0xcf, 0x55, 0x01, 0x83, 0x75]) + + +def read_der_length(data, offset): + b = data[offset] + if b < 0x80: + return b, 1 + num_bytes = b & 0x7f + length = 0 + for i in range(num_bytes): + length = (length << 8) | data[offset + 1 + i] + return length, 1 + num_bytes + + +def encode_der_length(length): + if length < 0x80: + return bytes([length]) + elif length < 0x100: + return bytes([0x81, length]) + elif length < 0x10000: + return bytes([0x82, length >> 8, length & 0xff]) + else: + raise ValueError("Length too large: %d" % length) + + +def find_enclosing_sequences(data, target_pos): + """Find length-field offsets of all SEQUENCEs enclosing target_pos.""" + results = [] + + def scan(offset, end): + while offset < end: + tag = data[offset] + offset += 1 + length, len_bytes = read_der_length(data, offset) + len_offset = offset + offset += len_bytes + content_start = offset + content_end = offset + length + + if tag == 0x30 and content_start <= target_pos < content_end: + results.append((len_offset, length, len_bytes)) + scan(content_start, content_end) + return + offset = content_end + + scan(0, len(data)) + return results + + +def patch_tbs_spki_oid(tbs_der): + """Replace id-ecPublicKey with SM2 OID in TBS SubjectPublicKeyInfo.""" + oid_pos = tbs_der.find(EC_PUBKEY_OID) + if oid_pos == -1: + return None # Already has SM2 OID or no EC key + + enclosing = find_enclosing_sequences(tbs_der, oid_pos) + size_diff = len(SM2_ALGO_OID) - len(EC_PUBKEY_OID) + + result = bytearray( + tbs_der[:oid_pos] + SM2_ALGO_OID + tbs_der[oid_pos + len(EC_PUBKEY_OID):] + ) + + for len_offset, old_length, old_len_bytes in enclosing: + new_length = old_length + size_diff + new_len_encoded = encode_der_length(new_length) + if len(new_len_encoded) == old_len_bytes: + result[len_offset:len_offset + old_len_bytes] = new_len_encoded + else: + result[len_offset:len_offset + old_len_bytes] = new_len_encoded + size_diff += len(new_len_encoded) - old_len_bytes + + return bytes(result) + + +def pem_to_der(pem_text): + b64 = ''.join( + line for line in pem_text.split('\n') + if not line.startswith('-----') and line.strip() + ) + return base64.b64decode(b64) + + +def der_to_pem(der_data, label="CERTIFICATE"): + b64 = base64.b64encode(der_data).decode() + lines = [b64[i:i+64] for i in range(0, len(b64), 64)] + return ('-----BEGIN %s-----\n' % label + + '\n'.join(lines) + + '\n-----END %s-----\n' % label) + + +def extract_tbs(cert_der): + assert cert_der[0] == 0x30 + outer_len, outer_len_bytes = read_der_length(cert_der, 1) + tbs_offset = 1 + outer_len_bytes + tbs_len, tbs_len_bytes = read_der_length(cert_der, tbs_offset + 1) + tbs_total = 1 + tbs_len_bytes + tbs_len + return cert_der[tbs_offset:tbs_offset + tbs_total] + + +def sign_tbs(tbs_der, key_pem_path): + """Sign TBS with SM2-with-SM3 using openssl dgst.""" + with tempfile.NamedTemporaryFile(suffix='.der', delete=False) as tbs_f: + tbs_f.write(tbs_der) + tbs_path = tbs_f.name + + sig_path = tbs_path + '.sig' + try: + result = subprocess.run( + ['openssl', 'dgst', '-sm3', '-sign', key_pem_path, + '-out', sig_path, tbs_path], + capture_output=True, text=True + ) + if result.returncode != 0: + raise RuntimeError("openssl dgst failed: " + result.stderr) + + with open(sig_path, 'rb') as f: + return f.read() + finally: + os.unlink(tbs_path) + if os.path.exists(sig_path): + os.unlink(sig_path) + + +def build_cert(tbs_der, sig_der): + bit_string = bytes([0x03, len(sig_der) + 1, 0x00]) + sig_der + cert_body = tbs_der + SM2_WITH_SM3 + bit_string + return bytes([0x30]) + encode_der_length(len(cert_body)) + cert_body + + +def fix_sm2_cert(cert_pem_path, key_pem_path, output_pem_path): + with open(cert_pem_path, 'r') as f: + cert_pem = f.read() + + cert_der = pem_to_der(cert_pem) + tbs = extract_tbs(cert_der) + + new_tbs = patch_tbs_spki_oid(tbs) + if new_tbs is None: + print(" Already has SM2 OID, no patching needed") + if cert_pem_path != output_pem_path: + with open(output_pem_path, 'w') as f: + f.write(cert_pem) + return + + sig = sign_tbs(new_tbs, key_pem_path) + new_cert_der = build_cert(new_tbs, sig) + + with open(output_pem_path, 'w') as f: + f.write(der_to_pem(new_cert_der)) + + print(" Patched SPKI algorithm OID to SM2") + + +if __name__ == '__main__': + if len(sys.argv) != 4: + print("Usage: %s " % sys.argv[0]) + sys.exit(1) + + fix_sm2_cert(sys.argv[1], sys.argv[2], sys.argv[3]) diff --git a/certs/sm2/gen-sm2-certs.sh b/certs/sm2/gen-sm2-certs.sh index 46f2a8cd50..33c459f370 100755 --- a/certs/sm2/gen-sm2-certs.sh +++ b/certs/sm2/gen-sm2-certs.sh @@ -1,5 +1,7 @@ #!/usr/bin/env bash +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" + check_result(){ if [ $1 -ne 0 ]; then echo "Failed at \"$2\", Abort" @@ -9,6 +11,15 @@ check_result(){ fi } +# OpenSSL 3.x encodes SM2 keys using the generic id-ecPublicKey OID instead of +# the SM2-specific OID. fix_sm2_spki.py patches the SubjectPublicKeyInfo +# algorithm OID back to SM2 and re-signs the certificate. +fix_sm2_oid(){ + # $1 = cert PEM, $2 = signing key PEM + python3 "${SCRIPT_DIR}/fix_sm2_spki.py" "$1" "$2" "$1" + check_result $? "Fix SM2 SPKI OID in $1" +} + openssl pkey -in root-sm2-priv.pem -noout >/dev/null 2>&1 if [ $? -ne 0 ]; then echo "OpenSSL does not support SM2" @@ -29,6 +40,7 @@ check_result $? "Generate request" openssl x509 -req -in root-sm2.csr -days 1000 -extfile ../renewcerts/wolfssl.cnf -extensions ca_ecc_cert -signkey root-sm2-priv.pem -out root-sm2.pem check_result $? "Generate certificate" rm root-sm2.csr +fix_sm2_oid root-sm2.pem root-sm2-priv.pem openssl x509 -in root-sm2.pem -outform DER > root-sm2.der check_result $? "Convert to DER" @@ -50,6 +62,7 @@ check_result $? "Generate request" openssl x509 -req -in ca-sm2.csr -days 1000 -extfile ../renewcerts/wolfssl.cnf -extensions ca_ecc_cert -CA root-sm2.pem -CAkey root-sm2-priv.pem -set_serial 01 -out ca-sm2.pem check_result $? "Generate certificate" rm ca-sm2.csr +fix_sm2_oid ca-sm2.pem root-sm2-priv.pem openssl x509 -in ca-sm2.pem -outform DER > ca-sm2.der check_result $? "Convert to DER" @@ -71,6 +84,7 @@ check_result $? "Generate request" openssl x509 -req -in self-sm2.csr -days 1000 -extfile ../renewcerts/wolfssl.cnf -extensions ca_ecc_cert -signkey self-sm2-priv.pem -out self-sm2-cert.pem check_result $? "Generate certificate" rm self-sm2.csr +fix_sm2_oid self-sm2-cert.pem self-sm2-priv.pem openssl x509 -in self-sm2-cert.pem -text > tmp.pem check_result $? "Add text" @@ -90,6 +104,7 @@ check_result $? "Generate request" openssl x509 -req -in server-sm2.csr -days 1000 -extfile ../renewcerts/wolfssl.cnf -extensions server_ecc -CA ca-sm2.pem -CAkey ca-sm2-priv.pem -set_serial 01 -out server-sm2-cert.pem check_result $? "Generate certificate" rm server-sm2.csr +fix_sm2_oid server-sm2-cert.pem ca-sm2-priv.pem openssl x509 -in server-sm2-cert.pem -outform DER > server-sm2-cert.der check_result $? "Convert to DER" @@ -113,6 +128,7 @@ check_result $? "Generate request" openssl x509 -req -in client-sm2.csr -days 1000 -extfile ../renewcerts/wolfssl.cnf -extensions wolfssl_opts -signkey client-sm2-priv.pem -out client-sm2.pem check_result $? "Generate certificate" rm client-sm2.csr +fix_sm2_oid client-sm2.pem client-sm2-priv.pem openssl x509 -in client-sm2.pem -outform DER > client-sm2.der check_result $? "Convert to DER" diff --git a/certs/sm2/root-sm2.der b/certs/sm2/root-sm2.der index d94887dbc1313e2469cd338680f4c9c3683a4eb6..47550ba91435644f320d02ae4924620b93bcd0e8 100644 GIT binary patch delta 154 zcmbQnI-OP7powX+K@*e30%j&gCMJcN@UAORCwcXnzcWamw87}Ob?X~iJ(8063d)hST9eMQeSKH@e#z)pi&&=f7 IeR#z?01O;K@&Et; delta 153 zcmbQvI*nD?powXcK@*et0%j&gCMFS=lYfj^vu(cr5oKcf7Tz}LRNW!NiOTCmO^nQq z%%a43jVufe4NVLo+===#c_Iyj+1Rz(JkHrNF;4DfJnr27k$J(^%J4+Bx?))Y{X4H8 zsd_DDQ!nSe@a1i9a8h#~lOn^m7u*$VzEwVS3V7(2k#Fy9_S3=B8$*=27CjMiz#Kh9-s(u0i95iSizk%@{LzqYOmY zIJ6pN&WAEK=}unF_}t5r!N844kzrauyq*1ixqzHmv3`B;)ff8y+F80Rg74ey1S5qf shO%Z%iVV+B$INf7_1PLy^2GJX2gcw)WA?im$Bw)IzjkNCL$fp10F7)kkpKVy delta 139 zcmcc1dYhHQpo!_aK@(H$M2>S3CPwB)W>Mn2Miz#Kh9-s(u0i95iSizk%@{LzA`OJu z*tOa`&e<|CPF}z?DgXUGPbYQ!QWKfYPF r-Z3dM{Qg?B?M%+3YZe)dM^~Soef`dv-T4-N(yg`E=PY@Die diff --git a/certs/sm2/server-sm2-cert.pem b/certs/sm2/server-sm2-cert.pem index bee875ded9..f21400f20b 100644 --- a/certs/sm2/server-sm2-cert.pem +++ b/certs/sm2/server-sm2-cert.pem @@ -5,11 +5,11 @@ Certificate: Signature Algorithm: SM2-with-SM3 Issuer: C=US, ST=Montana, L=Bozeman, O=wolfSSL_sm2, OU=CA-sm2, CN=www.wolfssl.com, emailAddress=info@wolfssl.com, UID=wolfSSL Validity - Not Before: Feb 18 14:27:26 2026 GMT - Not After : Nov 14 14:27:26 2028 GMT + Not Before: Feb 18 17:56:57 2026 GMT + Not After : Nov 14 17:56:57 2028 GMT Subject: C=US, ST=Montana, L=Bozeman, O=wolfSSL_sm2, OU=Server-sm2, CN=www.wolfssl.com, emailAddress=info@wolfssl.com, UID=wolfSSL Subject Public Key Info: - Public Key Algorithm: id-ecPublicKey + Public Key Algorithm: sm2 Public-Key: (256 bit) pub: 04:94:70:2b:46:e4:5e:0f:41:fb:8f:2d:34:0a:41: @@ -33,25 +33,25 @@ Certificate: SSL Server Signature Algorithm: SM2-with-SM3 Signature Value: - 30:45:02:20:07:11:e4:64:42:5a:2b:74:1d:7d:bb:81:33:7f: - fd:5c:bd:93:f5:73:09:fc:23:5a:c4:f6:94:fc:4d:6a:da:ee: - 02:21:00:fb:f5:72:b6:cc:6c:92:d6:38:68:01:c5:ab:cb:9b: - d7:dc:cc:bb:6f:38:4e:1b:85:7d:d7:9c:a4:ed:b8:29:c8 + 30:46:02:21:00:96:50:5f:3e:3f:bf:1e:50:6c:9a:5d:4e:8e: + ef:27:a1:4d:fa:b9:75:a6:58:0e:f6:db:60:32:20:e4:31:1d: + 36:02:21:00:e7:cb:5c:9f:85:7d:4c:b5:54:74:e4:45:c4:f0: + 01:53:51:33:07:dd:28:c6:c7:47:ff:d6:dc:b0:e1:36:cc:3b -----BEGIN CERTIFICATE----- -MIIC1zCCAn2gAwIBAgIBATAKBggqgRzPVQGDdTCBrDELMAkGA1UEBhMCVVMxEDAO +MIIC2TCCAn6gAwIBAgIBATAKBggqgRzPVQGDdTCBrDELMAkGA1UEBhMCVVMxEDAO BgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0JvemVtYW4xFDASBgNVBAoMC3dvbGZT U0xfc20yMQ8wDQYDVQQLDAZDQS1zbTIxGDAWBgNVBAMMD3d3dy53b2xmc3NsLmNv bTEfMB0GCSqGSIb3DQEJARYQaW5mb0B3b2xmc3NsLmNvbTEXMBUGCgmSJomT8ixk -AQEMB3dvbGZTU0wwHhcNMjYwMjE4MTQyNzI2WhcNMjgxMTE0MTQyNzI2WjCBsDEL +AQEMB3dvbGZTU0wwHhcNMjYwMjE4MTc1NjU3WhcNMjgxMTE0MTc1NjU3WjCBsDEL MAkGA1UEBhMCVVMxEDAOBgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0JvemVtYW4x FDASBgNVBAoMC3dvbGZTU0xfc20yMRMwEQYDVQQLDApTZXJ2ZXItc20yMRgwFgYD VQQDDA93d3cud29sZnNzbC5jb20xHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNz -bC5jb20xFzAVBgoJkiaJk/IsZAEBDAd3b2xmU1NMMFkwEwYHKoZIzj0CAQYIKoEc -z1UBgi0DQgAElHArRuReD0H7jy00CkFAGV771B0RrPr1kzfG+ocI9xYfLM4wQJ1P -pioKodaVM8OmA5jmjQU0sJcM3qTHz1OP0aOBiTCBhjAdBgNVHQ4EFgQUZ65g/34b -D5WuH4JZ8mxWLZPvFzIwHwYDVR0jBBgwFoAURwpIfrsCqFomVysZqXthi39dmW4w -DAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCA6gwEwYDVR0lBAwwCgYIKwYBBQUH -AwEwEQYJYIZIAYb4QgEBBAQDAgZAMAoGCCqBHM9VAYN1A0gAMEUCIAcR5GRCWit0 -HX27gTN//Vy9k/VzCfwjWsT2lPxNatruAiEA+/VytsxsktY4aAHFq8ub19zMu284 -ThuFfdecpO24Kcg= +bC5jb20xFzAVBgoJkiaJk/IsZAEBDAd3b2xmU1NMMFowFAYIKoEcz1UBgi0GCCqB +HM9VAYItA0IABJRwK0bkXg9B+48tNApBQBle+9QdEaz69ZM3xvqHCPcWHyzOMECd +T6YqCqHWlTPDpgOY5o0FNLCXDN6kx89Tj9GjgYkwgYYwHQYDVR0OBBYEFGeuYP9+ +Gw+Vrh+CWfJsVi2T7xcyMB8GA1UdIwQYMBaAFEcKSH67AqhaJlcrGal7YYt/XZlu +MAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgOoMBMGA1UdJQQMMAoGCCsGAQUF +BwMBMBEGCWCGSAGG+EIBAQQEAwIGQDAKBggqgRzPVQGDdQNJADBGAiEAllBfPj+/ +HlBsml1Oju8noU36uXWmWA7222AyIOQxHTYCIQDny1yfhX1MtVR05EXE8AFTUTMH +3SjGx0f/1tyw4TbMOw== -----END CERTIFICATE----- diff --git a/certs/sm2/server-sm2.pem b/certs/sm2/server-sm2.pem index eb8d804829..ecb96ac2ee 100644 --- a/certs/sm2/server-sm2.pem +++ b/certs/sm2/server-sm2.pem @@ -5,11 +5,11 @@ Certificate: Signature Algorithm: SM2-with-SM3 Issuer: C=US, ST=Montana, L=Bozeman, O=wolfSSL_sm2, OU=CA-sm2, CN=www.wolfssl.com, emailAddress=info@wolfssl.com, UID=wolfSSL Validity - Not Before: Feb 18 14:27:26 2026 GMT - Not After : Nov 14 14:27:26 2028 GMT + Not Before: Feb 18 17:56:57 2026 GMT + Not After : Nov 14 17:56:57 2028 GMT Subject: C=US, ST=Montana, L=Bozeman, O=wolfSSL_sm2, OU=Server-sm2, CN=www.wolfssl.com, emailAddress=info@wolfssl.com, UID=wolfSSL Subject Public Key Info: - Public Key Algorithm: id-ecPublicKey + Public Key Algorithm: sm2 Public-Key: (256 bit) pub: 04:94:70:2b:46:e4:5e:0f:41:fb:8f:2d:34:0a:41: @@ -33,27 +33,27 @@ Certificate: SSL Server Signature Algorithm: SM2-with-SM3 Signature Value: - 30:45:02:20:07:11:e4:64:42:5a:2b:74:1d:7d:bb:81:33:7f: - fd:5c:bd:93:f5:73:09:fc:23:5a:c4:f6:94:fc:4d:6a:da:ee: - 02:21:00:fb:f5:72:b6:cc:6c:92:d6:38:68:01:c5:ab:cb:9b: - d7:dc:cc:bb:6f:38:4e:1b:85:7d:d7:9c:a4:ed:b8:29:c8 + 30:46:02:21:00:96:50:5f:3e:3f:bf:1e:50:6c:9a:5d:4e:8e: + ef:27:a1:4d:fa:b9:75:a6:58:0e:f6:db:60:32:20:e4:31:1d: + 36:02:21:00:e7:cb:5c:9f:85:7d:4c:b5:54:74:e4:45:c4:f0: + 01:53:51:33:07:dd:28:c6:c7:47:ff:d6:dc:b0:e1:36:cc:3b -----BEGIN CERTIFICATE----- -MIIC1zCCAn2gAwIBAgIBATAKBggqgRzPVQGDdTCBrDELMAkGA1UEBhMCVVMxEDAO +MIIC2TCCAn6gAwIBAgIBATAKBggqgRzPVQGDdTCBrDELMAkGA1UEBhMCVVMxEDAO BgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0JvemVtYW4xFDASBgNVBAoMC3dvbGZT U0xfc20yMQ8wDQYDVQQLDAZDQS1zbTIxGDAWBgNVBAMMD3d3dy53b2xmc3NsLmNv bTEfMB0GCSqGSIb3DQEJARYQaW5mb0B3b2xmc3NsLmNvbTEXMBUGCgmSJomT8ixk -AQEMB3dvbGZTU0wwHhcNMjYwMjE4MTQyNzI2WhcNMjgxMTE0MTQyNzI2WjCBsDEL +AQEMB3dvbGZTU0wwHhcNMjYwMjE4MTc1NjU3WhcNMjgxMTE0MTc1NjU3WjCBsDEL MAkGA1UEBhMCVVMxEDAOBgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0JvemVtYW4x FDASBgNVBAoMC3dvbGZTU0xfc20yMRMwEQYDVQQLDApTZXJ2ZXItc20yMRgwFgYD VQQDDA93d3cud29sZnNzbC5jb20xHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNz -bC5jb20xFzAVBgoJkiaJk/IsZAEBDAd3b2xmU1NMMFkwEwYHKoZIzj0CAQYIKoEc -z1UBgi0DQgAElHArRuReD0H7jy00CkFAGV771B0RrPr1kzfG+ocI9xYfLM4wQJ1P -pioKodaVM8OmA5jmjQU0sJcM3qTHz1OP0aOBiTCBhjAdBgNVHQ4EFgQUZ65g/34b -D5WuH4JZ8mxWLZPvFzIwHwYDVR0jBBgwFoAURwpIfrsCqFomVysZqXthi39dmW4w -DAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCA6gwEwYDVR0lBAwwCgYIKwYBBQUH -AwEwEQYJYIZIAYb4QgEBBAQDAgZAMAoGCCqBHM9VAYN1A0gAMEUCIAcR5GRCWit0 -HX27gTN//Vy9k/VzCfwjWsT2lPxNatruAiEA+/VytsxsktY4aAHFq8ub19zMu284 -ThuFfdecpO24Kcg= +bC5jb20xFzAVBgoJkiaJk/IsZAEBDAd3b2xmU1NMMFowFAYIKoEcz1UBgi0GCCqB +HM9VAYItA0IABJRwK0bkXg9B+48tNApBQBle+9QdEaz69ZM3xvqHCPcWHyzOMECd +T6YqCqHWlTPDpgOY5o0FNLCXDN6kx89Tj9GjgYkwgYYwHQYDVR0OBBYEFGeuYP9+ +Gw+Vrh+CWfJsVi2T7xcyMB8GA1UdIwQYMBaAFEcKSH67AqhaJlcrGal7YYt/XZlu +MAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgOoMBMGA1UdJQQMMAoGCCsGAQUF +BwMBMBEGCWCGSAGG+EIBAQQEAwIGQDAKBggqgRzPVQGDdQNJADBGAiEAllBfPj+/ +HlBsml1Oju8noU36uXWmWA7222AyIOQxHTYCIQDny1yfhX1MtVR05EXE8AFTUTMH +3SjGx0f/1tyw4TbMOw== -----END CERTIFICATE----- Certificate: Data: @@ -62,11 +62,11 @@ Certificate: Signature Algorithm: SM2-with-SM3 Issuer: C=US, ST=Montana, L=Bozeman, O=wolfSSL_SM2, OU=Root-SM2, CN=www.wolfssl.com, emailAddress=info@wolfssl.com Validity - Not Before: Feb 18 14:27:26 2026 GMT - Not After : Nov 14 14:27:26 2028 GMT + Not Before: Feb 18 17:56:57 2026 GMT + Not After : Nov 14 17:56:57 2028 GMT Subject: C=US, ST=Montana, L=Bozeman, O=wolfSSL_sm2, OU=CA-sm2, CN=www.wolfssl.com, emailAddress=info@wolfssl.com, UID=wolfSSL Subject Public Key Info: - Public Key Algorithm: id-ecPublicKey + Public Key Algorithm: sm2 Public-Key: (256 bit) pub: 04:21:92:f7:cb:24:df:64:4d:ba:ab:66:7b:83:75: @@ -86,23 +86,23 @@ Certificate: Digital Signature, Certificate Sign, CRL Sign Signature Algorithm: SM2-with-SM3 Signature Value: - 30:46:02:21:00:ba:6b:14:b0:ef:08:bf:4c:32:63:62:2e:e1: - 5d:04:d9:45:04:79:c9:bf:9a:93:9f:05:44:f5:e6:33:64:b4: - 7e:02:21:00:e3:17:fe:87:35:30:f2:3b:ab:16:2d:5e:30:76: - 42:4e:cc:85:96:b9:2f:af:55:00:a5:4f:43:7c:13:54:3f:4f + 30:46:02:21:00:b2:b9:5b:02:ad:78:f8:52:ba:67:cf:cb:25: + 9b:ba:d9:56:f5:a7:ff:af:25:26:d5:f6:f3:f3:a6:f5:9a:2f: + 9b:02:21:00:bc:96:f3:39:13:76:dc:02:35:39:0e:dc:0a:69: + bf:02:18:b6:01:be:ff:05:d7:2e:f2:7b:67:eb:16:e9:8e:c5 -----BEGIN CERTIFICATE----- -MIICljCCAjugAwIBAgIBATAKBggqgRzPVQGDdTCBlTELMAkGA1UEBhMCVVMxEDAO +MIIClzCCAjygAwIBAgIBATAKBggqgRzPVQGDdTCBlTELMAkGA1UEBhMCVVMxEDAO BgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0JvemVtYW4xFDASBgNVBAoMC3dvbGZT U0xfU00yMREwDwYDVQQLDAhSb290LVNNMjEYMBYGA1UEAwwPd3d3LndvbGZzc2wu -Y29tMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tMB4XDTI2MDIxODE0 -MjcyNloXDTI4MTExNDE0MjcyNlowgawxCzAJBgNVBAYTAlVTMRAwDgYDVQQIDAdN +Y29tMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tMB4XDTI2MDIxODE3 +NTY1N1oXDTI4MTExNDE3NTY1N1owgawxCzAJBgNVBAYTAlVTMRAwDgYDVQQIDAdN b250YW5hMRAwDgYDVQQHDAdCb3plbWFuMRQwEgYDVQQKDAt3b2xmU1NMX3NtMjEP MA0GA1UECwwGQ0Etc20yMRgwFgYDVQQDDA93d3cud29sZnNzbC5jb20xHzAdBgkq hkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20xFzAVBgoJkiaJk/IsZAEBDAd3b2xm -U1NMMFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAEIZL3yyTfZE26q2Z7g3WpKef/ -ZGO21UKAIL3i4gISO460AJUJgMtW7UvKjVfmrgXTdidjcTmJt2nmSICu0alIEqNj -MGEwHQYDVR0OBBYEFEcKSH67AqhaJlcrGal7YYt/XZluMB8GA1UdIwQYMBaAFDQd -eUQVeaGxY5nj7WV8ZImA/7jsMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQD -AgGGMAoGCCqBHM9VAYN1A0kAMEYCIQC6axSw7wi/TDJjYi7hXQTZRQR5yb+ak58F -RPXmM2S0fgIhAOMX/oc1MPI7qxYtXjB2Qk7MhZa5L69VAKVPQ3wTVD9P +U1NMMFowFAYIKoEcz1UBgi0GCCqBHM9VAYItA0IABCGS98sk32RNuqtme4N1qSnn +/2RjttVCgCC94uICEjuOtACVCYDLVu1Lyo1X5q4F03YnY3E5ibdp5kiArtGpSBKj +YzBhMB0GA1UdDgQWBBRHCkh+uwKoWiZXKxmpe2GLf12ZbjAfBgNVHSMEGDAWgBQ0 +HXlEFXmhsWOZ4+1lfGSJgP+47DAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQE +AwIBhjAKBggqgRzPVQGDdQNJADBGAiEAsrlbAq14+FK6Z8/LJZu62Vb1p/+vJSbV +9vPzpvWaL5sCIQC8lvM5E3bcAjU5DtwKab8CGLYBvv8F1y7ye2frFumOxQ== -----END CERTIFICATE-----