Java Empty issuer DN not allowed in X509Certificate (Libimobiledevice implementation)

Question

I am working hard on an open project to implement Libimobiledevice library in Java.

I already had implement Usbmuxd / PlistService / DeviceConnexion etc..

All working good, except when I am trying to wrap the SSL Socket.

According to the different implementation made in C (Libimobiledevice) or in Python (pymobiledevice), I generate the X509Certificat using the PEM provided during the Host & Device pairing.

I use this following PEM to generate my X509Certificat (first generated using libimobiledevice) :

When I decode this PEM File , I can see there is no DN provided in this key.

And during the SSLHandshake I receive this Exception :

Exception in thread "main" java.io.IOException: java.io.IOException: javax.net.ssl.SSLProtocolException: Empty issuer DN not allowed in X509Certificates

And this is the part of my code causing this Exception :

SSLSocket sslSocket = (SSLSocket) SSLContext.getDefault().getSocketFactory().createSocket(socket, "127.0.0.1", 62078, true);
                System.out.println("Socket open");
                
                sslSocket.setEnabledCipherSuites(new String[] { "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" });
                sslSocket.setEnabledProtocols(new String[] { "TLSv1.2" });
                try{
                    sslSocket.startHandshake();
                    System.out.println("================================Socket open success");
                }catch(Exception e){
                    throw new IOException(e);
                }

There is a way to bypass the "Empty issuer Exception" in Java ? or Someone do have an other idea ? I really need your help on this.

Thank you.

It seems an empty subject DN is valid per [RFC 5280](https://tools.ietf.org/rfc/rfc5280.txt), but an empty subject DN (or issuer DN) may mean the certificate is not valid for use in an SSL connection. — Andrew Henle, Jan 12 '21 at 21:29
You may be able to disable hostname validation. https://www.google.com/search?q=java+disable+ssl+hostname+verification There's no name on the cert to verify anyway. The certificate itself should still be validated against your truststore, though, so it should still be secure. — Andrew Henle, Jan 12 '21 at 22:20
Trying to add this java option -Dtrust_all_cert=true but nothing change. — De Filippi JM, Jan 12 '21 at 22:36
According to this line on pymobile project `ssl.wrap_socket(self.s, keyfile, certfile, ssl_version=ssl.PROTOCOL_TLSv1)` the keyfile and certfile seem to use the PEM file provided in my code — De Filippi JM, Jan 12 '21 at 22:37
@AndrewHenle in complement during the SSL handshake the `Socket Write` seem working good. Only when the `Socket Read` the answer I got this Exception. — De Filippi JM, Jan 12 '21 at 22:44
*Trying to add this java option -Dtrust_all_cert=true but nothing change.* I'm pretty sure all that does is assume the certificate is trusted - it doesn't have to check if that cert is either in your trust store or signed by a cert in your trust store. It's still going to do host name verification to make sure the SSL connect is to the server it's supposed to go to - there might be a Java property to skip that, but I don't think so. You're probably going to have to code up a null host name verifier and use it in a custom SSLContext. — Andrew Henle, Jan 13 '21 at 10:07

Attect · Answer 1 · 2022-08-05T08:40:31.650

I'm create a tool with compose-jb, same problem. Finally I modify OpenJDK18 solved this problem.

Patch:

Index: src/java.base/share/classes/sun/security/ssl/CertificateMessage.java
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
diff --git a/src/java.base/share/classes/sun/security/ssl/CertificateMessage.java b/src/java.base/share/classes/sun/security/ssl/CertificateMessage.java
--- a/src/java.base/share/classes/sun/security/ssl/CertificateMessage.java  (revision 70d808deca55534a5a1376cccd0a35202d4fc091)
+++ b/src/java.base/share/classes/sun/security/ssl/CertificateMessage.java  (revision 74ae6f2acacb6ea332e9413d2d3da75af3c7fac9)
@@ -635,10 +635,14 @@
                             engine);
                     } else {
                         SSLSocket socket = (SSLSocket)chc.conContext.transport;
-                        ((X509ExtendedTrustManager)tm).checkServerTrusted(
-                            certs.clone(),
-                            keyExchangeString,
-                            socket);
+                        // Unix Socket skip check
+                        // Windows usbmuxd on port 27015 skip check
+                        if(!(socket.getPort() == 0 || socket.getPort() == 27015)){
+                            ((X509ExtendedTrustManager)tm).checkServerTrusted(
+                                    certs.clone(),
+                                    keyExchangeString,
+                                    socket);
+                        }
                     }
                 } else {
                     // Unlikely to happen, because we have wrapped the old
Index: src/java.base/share/classes/sun/security/x509/X509CertInfo.java
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
diff --git a/src/java.base/share/classes/sun/security/x509/X509CertInfo.java b/src/java.base/share/classes/sun/security/x509/X509CertInfo.java
--- a/src/java.base/share/classes/sun/security/x509/X509CertInfo.java   (revision 70d808deca55534a5a1376cccd0a35202d4fc091)
+++ b/src/java.base/share/classes/sun/security/x509/X509CertInfo.java   (revision 74ae6f2acacb6ea332e9413d2d3da75af3c7fac9)
@@ -655,8 +655,9 @@
         // Issuer name
         issuer = new X500Name(in);
         if (issuer.isEmpty()) {
-            throw new CertificateParsingException(
-                "Empty issuer DN not allowed in X509Certificates");
+            issuer = new X500Name("");
+//            throw new CertificateParsingException(
+//                "Empty issuer DN not allowed in X509Certificates");
         }
 
         // validity:  SEQUENCE { start date, end date }
@@ -710,7 +711,9 @@
         }
 
         // verify X.509 V3 Certificate
-        verifyCert(subject, extensions);
+        if(!issuer.isEmpty()){
+            verifyCert(subject, extensions);
+        }
 
     }

Or $openJDK18Dir/src/java.base/share/classes/sun/security/ssl/CertificateMessage.java
near line 638

                        // Unix Socket skip check
                        // Windows usbmuxd on port 27015 skip check
                        if(!(socket.getPort() == 0 || socket.getPort() == 27015)){
                            ((X509ExtendedTrustManager)tm).checkServerTrusted(
                                    certs.clone(),
                                    keyExchangeString,
                                    socket);
                        }

$openJDK18Dir/src/java.base/share/classes/sun/security/ssl/CertificateMessage.java private void parse(DerValue val)

    issuer = new X500Name("");

    if(!issuer.isEmpty()){
        verifyCert(subject, extensions);
    }

Java Empty issuer DN not allowed in X509Certificate (Libimobiledevice implementation)

1 Answers1