Invalid certificate chain error using Neowave Winkeo key

[Florent-Coudrier]

Hello,

I'm currently performing some tests with different Fido2 keys and have an issue with one of the them: Neowave Winkeo model.
(https://neowave.fr/fr/produits/gamme-fido-2/winkeo-c-fido-2/)

When I try to register the key, I receive this error from the library:

Fido2NetLib.Fido2VerificationException: Invalid certificate chain
at Fido2NetLib.AuthenticatorAttestationResponse.VerifyAsync(CredentialCreateOptions originalOptions, Fido2Configuration config, IsCredentialIdUniqueToUserAsyncDelegate isCredentialIdUniqueToUser, IMetadataService metadataService, Byte[] requestTokenBindingId, CancellationToken cancellationToken)
at Fido2NetLib.Fido2.MakeNewCredentialAsync(AuthenticatorAttestationRawResponse attestationResponse, CredentialCreateOptions origChallenge, IsCredentialIdUniqueToUserAsyncDelegate isCredentialIdUniqueToUser, Byte[] requestTokenBindingId, CancellationToken cancellationToken)
at TB.Fido.Server.Api.Impl.Login.Current.Registration.MakeCredentialCommandHandler.Handle(MakeCredentialCommand request, CancellationToken cancellationToken)

After investigation, it appears that disabling the online revocation check make the registration works. (CRLDP extension is present in the attestation certificate)
To make it work, I basically commented this line like this:

// if the attestation cert has a CDP extension, go ahead and turn on online revocation checking if (!string.IsNullOrEmpty(CDPFromCertificateExts(trustPath[0].Extensions)) && validationMode != FidoValidationMode.FidoConformance2024) //chain.ChainPolicy.RevocationMode = X509RevocationMode.Online;

I've seen some similar issues regarding the trust path chain validation, but it looks like this issue is different.

If you have any idea or solution about that, I would love it.

Thank you

[aseigler]

If you can please provide a sample registration output, I would like try to get all the trust path issues put to bed prior to the next release.

[Florent-Coudrier]

Hello,

Here is a sample registration output from WebAuthn.

{ "id": "fkZPgHmaGs0RnxzAw5zMmzFlQPtNTNj7_6dwV-Rey8M", "rawId": "fkZPgHmaGs0RnxzAw5zMmzFlQPtNTNj7_6dwV-Rey8M", "type": "public-key", "extensions": {}, "response": { "attestationObject": "o2NmbXRmcGFja2VkZ2F0dFN0bXSjY2FsZyZjc2lnWEcwRQIgf-TKwKP3NRNIOMrkXEcUAomS4sjeyOJ_rR6kB7jFqKoCIQCZIUB1GvU9jqgVevgoLuo0OTRaToXU7vQ7m-8M7748-2N4NWOBWQSdMIIEmTCCBD-gAwIBAgIQZoGUWqM7jnhW2nmV4EZW1jAKBggqhkjOPQQDAjB0MQswCQYDVQQGEwJGUjETMBEGA1UEChMKQ2VydEV1cm9wZTEXMBUGA1UECxMOMDAwMiA0MzQyMDIxODAxHTAbBgNVBAMTFENlcnRFdXJvcGUgSWRlY3lzIENBMRgwFgYDVQRhEw9OVFJGUi00MzQyMDIxODAwHhcNMjAwNjIyMTIzMjIzWhcNMjgwMTIxMjMwMDAwWjCBsDELMAkGA1UEBhMCRlIxEDAOBgNVBAoTB05FT1dBVkUxIjAgBgNVBAsTGUF1dGhlbnRpY2F0b3IgQXR0ZXN0YXRpb24xJjAkBgNVBAMTHUZJRE8yIEF0dGVzdGF0aW9uIENlcnRpZmljYXRlMREwDwYDVQQHEwhHYXJkYW5uZTEhMB8GCSqGSIb3DQEJARYSY29udGFjdEBuZW93YXZlLmZyMQ0wCwYDVQQIEwRQQUNBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE64J-F8-nXNC8pToUHRksVq2b5RFvr5lOOlK6zpj1y0GHgOITTS7DiVd6cN_GtQr2e78HS0NIi7Aw_1AuPs7kh6OCAnQwggJwMBMGA1UdJQQMMAoGCCsGAQUFBwMCMBMGA1UdIwQMMAqACENpBuFMW2NyMEwGCCsGAQUFBwEBBEAwPjA8BggrBgEFBQcwAoYwaHR0cDovL3d3dy5jZXJ0ZXVyb3BlLmZyL3JlZmVyZW5jZS9lY19pZGVjeXMuY3J0MFcGA1UdIARQME4wTAYNKoF6AWkrgxsBAQEBADA7MDkGCCsGAQUFBwIBFi1odHRwczovL3d3dy5jZXJ0ZXVyb3BlLmZyL2NoYWluZS1kZS1jb25maWFuY2UwggFKBgNVHR8EggFBMIIBPTBBoD-gPYY7aHR0cDovL3d3dy5jZXJ0ZXVyb3BlLmZyL3JlZmVyZW5jZS9jZXJ0ZXVyb3BlX2VjX2lkZWN5cy5jcmwwe6B5oHeGdWxkYXA6Ly9sY3IxLmNlcnRldXJvcGUuZnIvY249Q2VydEV1cm9wZSUyMElkZWN5cyUyMENBLG91PTAwMDIlMjA0MzQyMDIxODAsbz1DZXJ0RXVyb3BlLGM9RlI_Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdDB7oHmgd4Z1bGRhcDovL2xjcjIuY2VydGV1cm9wZS5mci9jbj1DZXJ0RXVyb3BlJTIwSWRlY3lzJTIwQ0Esb3U9MDAwMiUyMDQzNDIwMjE4MCxvPUNlcnRFdXJvcGUsYz1GUj9jZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0MBEGA1UdDgQKBAhMOoIVT46cGTAOBgNVHQ8BAf8EBAMCBPAwIQYLKwYBBAGC5RwBAQQEEgQQN4nakflDRryVw1DqIBLwOjAJBgNVHRMEAjAAMAoGCCqGSM49BAMCA0gAMEUCIQCzN40Mn6ZjEjc-EkfTEQBQQlrc9DQAo6TPDAB7s3ZtQgIgaYWXNanYmBPPcRxmpwXeO4g_t3lN3FPmvjdP2SXSOx9oYXV0aERhdGFYpEmWDeWIDoxodDQXD2R2YFuP5K65ooYyx5lc87qDHZdjRQAAAPo3idqR-UNGvJXDUOogEvA6ACB-Rk-AeZoazRGfHMDDnMybMWVA-01M2Pv_p3BX5F7Lw6UBAgMmIAEhWCC4-uaJY_iO-tqLGD50--2wxDg5RBcnlFEaWERzhKuYpiJYIJJlXkO7AuG4IMM9lOir_eP_ZtjHbZYfaRnBDLtQswfN", "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiRUdiUElHMGdwa2VtXzRnX0tNTjRPZyIsIm9yaWdpbiI6Imh0dHA6Ly9sb2NhbGhvc3Q6NTE4NSIsImNyb3NzT3JpZ2luIjpmYWxzZX0" } }

Thanks for your help.

When do you plan to perform the next library release ?

[aseigler]

The CDP is at http://www.certeurope.fr/reference/certeurope_ec_idecys.crl, it's empty and there are no obvious issues with it. Does your server lack outbound internet access or name resolution to get to the CRL file? That would certainly cause this sort of problem. I could not reproduce the problem you describe from my end.