Apple Mac (27)
DH Keys (39)
DSA Keys (70)
EC Keys (915)
Google Chrome (25)
Intermediate CA (152)
Java VM (29)
JDK Keytool (28)
Microsoft CertUtil (29)
Microsoft Edge (9)
Mozilla CertUtil (21)
Revoked Certificates (16)
Root CA (85)
RSA Keys (2556)
What Is (22)
OpenSSL "req -verify" - Error "wrong signature length"
Why I am getting the "wrong signature length" error when running the OpenSSL "req -verify" command?
If you are getting the "wrong signature length" error when running the OpenSSL "req -verify" command, the CSR you are trying to verify has invalid digital signature.
There 2 main possibilities for a CSR to have invalid digital signature:
The first case is unlikely to happen, if the CSR is generated by you. Unless someone hacked your computer.
The second case may happen, if you convert a certificate to CSR and sign it with the wrong private key.
For example, you find that your server certificate is about to expire. So you download it and use the "x509 -x509toreq" command to convert it to a new CSR. This ensures that the new CSR has exactly the same DN (Distinguished Name) fields as the existing certificate.
But if you are not able to find the private key that matches the public key in the certificate, and use another private key with the "x509 -x509toreq", you will end up with an invalid CSR of case 2 listed above.
In the test below, we are going to download linkedin.com certificate and convert it to a new CSR using my own private to sign. Of course, the new CSR will be no good.
C:\Users\fyicenter>\local\OpenSSL\openssl s_client -connect twitter.com:443 > twitter.crt C:\Users\fyicenter>\local\OpenSSL\openssl OpenSSL> x509 -x509toreq -in twitter.crt -signkey my_ca.key -out twitter.csr Getting request Private Key Enter pass phrase for my_ca.key:fyicenter Generating certificate request OpenSSL> req -verify -in twitter.csr -noout verify failure 6164:error:04091077:rsa routines:INT_RSA_VERIFY:wrong signature length: .\crypto\rsa\rsa_sign.c:186: 6164:error:0D0C5006:asn1 encoding routines:ASN1_item_verify:EVP lib: .\crypto\asn1\a_verify.c:218:
The error message in the "req -verify" command output confirms that twitter.csr is generated by the "x509 -x509toreq" command is invalid. Signing someone else's public key in the CSR with your private key is not acceptable.
⇒ OpenSSL "x509 -req" - Quick Way to Sign CSR
⇐ OpenSSL "x509 -x509toreq" - Conver Certificate to CSR
2020-10-03, 11272👍, 1💬
Certificate Summary: Subject: GlobalSign RSA OV SSL CA 2018 Issuer: GlobalSign Expiration: 2028-11-2...
Certificate Summary: Subject: *.virginia.edu Issuer: InCommon Server CA Expiration: 2014-06-08 23:59...
Certificate summary - Owner: www.apple.com, Apple Inc., L=Cupertino, ST=CALIFORNIA, US Issuer: Cyber...
Certificate Summary: Subject: VeriSign Class 3 Public Primary Certification Authority - G3 Issuer: V...
How to open and view a CRL (Certificate Revocation List) file? I just downloaded a CRL from the cert...