\nopenssl pkcs7 -inform DER -in payload.p7b -print_certs -text\n<\/pre><\/div>\n\n\n(2)<\/strong> Convert the binary DER format into PEM base64. openssl<\/code> expects PEM by default so we won’t have explicitly define DER with -inform DER<\/code> for each command. <\/p>\n\n\n\nopenssl pkcs7 -inform DER -outform PEM -in payload.p7b -out payload.p7m\n<\/pre><\/div>\n\n\n(3)<\/strong> Parse the payload.p7m<\/code> file to see all data not just certificates:<\/p>\n\n\n\nopenssl asn1parse -in payload.p7m\n<\/pre><\/div>\n\n\nLook for inner PKCS7 envelope defined as pkcs7-data<\/code>: <\/p>\n\n\n\n 0:d=0 hl=4 l=3029 cons: SEQUENCE \n 4:d=1 hl=2 l= 9 prim: OBJECT :pkcs7-signedData\n 15:d=1 hl=4 l=3014 cons: cont [ 0 ] \n 19:d=2 hl=4 l=3010 cons: SEQUENCE \n 23:d=3 hl=2 l= 1 prim: INTEGER :01\n 26:d=3 hl=2 l= 15 cons: SET \n 28:d=4 hl=2 l= 13 cons: SEQUENCE \n 30:d=5 hl=2 l= 9 prim: OBJECT :sha256\n 41:d=5 hl=2 l= 0 prim: NULL \n 43:d=3 hl=4 l=1514 cons: SEQUENCE \n 47:d=4 hl=2 l= 9 prim: OBJECT :pkcs7-data\n 58:d=4 hl=4 l=1499 cons: cont [ 0 ] \n 62:d=5 hl=4 l=1495 prim: OCTET STRING [HEX DUMP]:3080060..0000000000000\n<\/pre><\/div>\n\n\n(4)<\/strong> We are interested in the hexadecimal data, which in this example starts at offset 62. This is the encrypted inner PKCS#7 envelope containing the CSR and usually the SCEP challenge secret. Extract this data into a separate file.<\/p>\n\n\n\nopenssl asn1parse -in payload.p7m -strparse 62 -out inner_payload.p7m \n<\/pre><\/div>\n\n\n(5)<\/strong> Decrypt the inner PKCS7 envelope by using the SCEP server certificate and private key.<\/p>\n\n\n\nopenssl smime -decrypt -in inner_payload.p7m -inform DER -recip scep_server_certificate.crt -inkey scep_server_certificate.key -out inner_payload_decrypted.p7m\n<\/pre><\/div>\n\n\n(6)<\/strong> And finally read the CSR (Make sure to use OpenSSL and not LibreSSL for this one).<\/p>\n\n\n\nopenssl req -in inner_payload_decrypted.p7m -noout -text\n<\/pre><\/div>\n\n\n<\/p>\n","protected":false},"excerpt":{"rendered":"
MDM systems and the devices they manage do not always provide the necessary level of transparency for troubleshooting unexpected issues. Deploying certificates via SCEP is often one such case, where we may encounter multiple black boxes: It can be very useful to inspect exactly what the client sends to the server. For PKIOperation, the SCEP … <\/p>\n
Continue reading “Decrypting SCEP PKIOperation payload”<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1593","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/macadmin.cz\/index.php?rest_route=\/wp\/v2\/posts\/1593","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/macadmin.cz\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/macadmin.cz\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/macadmin.cz\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/macadmin.cz\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1593"}],"version-history":[{"count":3,"href":"https:\/\/macadmin.cz\/index.php?rest_route=\/wp\/v2\/posts\/1593\/revisions"}],"predecessor-version":[{"id":1596,"href":"https:\/\/macadmin.cz\/index.php?rest_route=\/wp\/v2\/posts\/1593\/revisions\/1596"}],"wp:attachment":[{"href":"https:\/\/macadmin.cz\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1593"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/macadmin.cz\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1593"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/macadmin.cz\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1593"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}