AirPrint Label Printer - Issue with Creating New TLS Certificate and Browser Compatibility

[sahayap]

Dear Michael,

I trust this message finds you in good health.

As you're aware, we've been actively developing AirPrint support for our label printer, and overall, the progress has been positive. However, there is one particular aspect that requires attention - the ability to create a new TLC (Trusted Label Certificate) directly from the Web Interface.

Upon completing the required details and attempting to generate a new certificate using the "Create New Certificate" button, we encountered a critical issue resulting in a segmentation fault.

Subsequent investigation into the matter revealed the root cause: the settings associated with the subjectAltName value for DNS names within the function tls_make_certificate, found in the system-webif.c file.

The specific line causing the segmentation fault is as follows:

if (!X509_EXTENSION_create_by_NID(&san_ext, NID_subject_alt_name, 0, san_asn1)) // Line: 2663

Upon analysis, it became evident that the variable san_pointer was not properly initialized to NULL:

X509_EXTENSION *san_ext; // Line: 2469

This omission led to unexpected behavior. By explicitly initializing san_ext to NULL and then subsequently freeing and reassigning it to NULL after use, the segmentation fault was resolved. The revised code snippet appears below:

X509_EXTENSION *san_ext = NULL; // Revised initialization
// ...
for (i = 0; i < num_alt_names; i++) {
    // The subjectAltName value for DNS names starts with a DNS: prefix...
    snprintf(dns_name, sizeof(dns_name), "DNS:%s", alt_names[i]); // Note Removed the Space between DNS: %s

    if ((san_asn1 = ASN1_OCTET_STRING_new()) == NULL)
        break;

    ASN1_OCTET_STRING_set(san_asn1, (unsigned char *)dns_name, (int)strlen(dns_name));
    if (!X509_EXTENSION_create_by_NID(&san_ext, NID_subject_alt_name, 0, san_asn1)) {
        ASN1_OCTET_STRING_free(san_asn1);
        break;
    }
    X509_add_ext(cert, san_ext, -1);
    X509_EXTENSION_free(san_ext);
    san_ext = NULL; // Freed and reassigned to NULL
    ASN1_OCTET_STRING_free(san_asn1);
}

This alteration now allows for the creation of a new TLS certificate without any segmentation faults. However, it has come to our attention that certificates generated in this manner are only compatible with Safari and not with Firefox, Edge, and Chrome.

It's noteworthy that our current setup employs openssl-1.1.1g in conjunction with pappl-1.3.2.

We are reaching out to seek your guidance on rectifying this compatibility issue with different browsers. Your expertise would be invaluable in addressing this concern.

Thank you for your time and assistance.

Best Regards,
Sahaya Darcius P

[michaelrsweet]

I have some pending changes to update the OpenSSL PKI support in PAPPL to what I've implemented in libcups3. In the meantime if you can re-file this as an issue (vs. a discussion topic) that would be useful for tracking the changes for PAPPL 1.4.