From f0d3e31e17b97b236bc1f994909f5d97519a7659 Mon Sep 17 00:00:00 2001 From: nickAS21 Date: Wed, 1 Dec 2021 20:45:32 +0200 Subject: [PATCH] lwm2m - cert trust must be signed certServer with 'CN' = {CN by server} --- .../TbLwM2MDtlsCertificateVerifier.java | 2 +- transport/lwm2m/src/main/data/lwm2mserver.jks | Bin 3849 -> 4017 bytes 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/common/transport/lwm2m/src/main/java/org/thingsboard/server/transport/lwm2m/secure/TbLwM2MDtlsCertificateVerifier.java b/common/transport/lwm2m/src/main/java/org/thingsboard/server/transport/lwm2m/secure/TbLwM2MDtlsCertificateVerifier.java index f3819edd7f..bae7522c78 100644 --- a/common/transport/lwm2m/src/main/java/org/thingsboard/server/transport/lwm2m/secure/TbLwM2MDtlsCertificateVerifier.java +++ b/common/transport/lwm2m/src/main/java/org/thingsboard/server/transport/lwm2m/secure/TbLwM2MDtlsCertificateVerifier.java @@ -199,7 +199,7 @@ public class TbLwM2MDtlsCertificateVerifier implements NewAdvancedCertificateVer for (int index = 0; index < certificates.length; ++index) { X509Certificate trust = certificates[index]; String trustCN = config.getTrustSslCredentials().getValueFromSubjectNameByKey(trust.getSubjectX500Principal().getName(), "CN"); - if (!StringUtils.isBlank(trustCN) && issuerCN.length() > trustCN.length() && issuerCN.substring(issuerCN.length()-trustCN.length()).equals(trustCN)) { + if (!StringUtils.isBlank(trustCN) && issuerCN.length() >= trustCN.length() && issuerCN.substring(issuerCN.length()-trustCN.length()).equals(trustCN)) { if (verifyCertificate(certificate)) { return certificate; } diff --git a/transport/lwm2m/src/main/data/lwm2mserver.jks b/transport/lwm2m/src/main/data/lwm2mserver.jks index 5fab824aa1b19928fe711701cd27857472a9e739..301f4e2c3ab90931eb166859e71b2c443fa35660 100644 GIT binary patch delta 3823 zcmVWMD_g+32hTgPAJ05L*Niz9d9Mp8eln zER&vN-Bs7nKyQw-PaFr8pvA=YW=JfN93(|(9P-FTu?lIDEm z;qOV$p<9tIz1Z41eM2n*0|3KN1c8{Xv4)Ij8iCt87v5-`igiWSfMtOlA10>Z!-&%M zARu94wV@adaLThd?Op@@q14J-tH`q`DXyi--VL7SgL_sk)Ew`7)DiOy(ym)CNF6anR zB**apRJ1%bqFGPBAa=fpGrLgdlQ{xCDKj`TI5ROdGB7weFoF#11_>&LNQU3HM3fk(JM(lIwZAEnkaB3Cw>R<@r5F;U+IL z9J~~BwU91fbA0XccZh83R1M%S*x~}?`7t}?FRy+g)`~nE5I5$>iB6~Zi^_3hJYX)0 zK%)|`hzun%NINB(Q92Z-w0Iv%>TY;tn*FjSuppzi@p9z2t$~?h5k$azsDHwB*R3!i zm?pt_y%Z_?&Z%}v{+oZsrX>xxmGH**I%%#b-Kl(KczW9e{^rLzKw0~OnWmLgvD{m) zHhX0eB1EcKH6;o_D@3dM{KA$9RQkxZ#8ZgUX7q#@{0p^T%E>+O@H!4tBgGh_Rs3%H z_!rc4l}HyDHpXllw;LHV$f|HQCL#5$gx5l4m+&>+ywmjQ37CI3U+X3lvc0MHK6Co; z8l#<}y8++-sI8}j({cpr4_m&XD~>rf!fv{N4{=EnmGI_XNEI7E=Cgll0-CiN-b(|% z4G7*7%GkcRa7VV&CqpGaru;+-yDm}lvN1$y7v8#6Pz*txugZS@U}NIHJOF+J1SSY&UMmt0FY12=-FS0e8n_fPofT_H11CM_|of}oS^I>nIG##8r0B2Oh(N7_2 zP}d!QJQ)1eue$to#XsW=0ajbIL$pya#{bsowmLe6ekKNFBDuX)?cXLtxzC07g)F*4GiLVTHa;v<( zxMd?ZQp&N+cTX^(((Ns+^+yI`#mND+_jhG)3@I?L78XrUl1;4;P zslAs@J|aD%8!%Rq*14g!@ttN2&#sd$aK3qqzBQLBe+I$RS8jv zBNy1UtI!@#FE2Dn!7#U((&&MUnW(G9qx0;RpDJRH0pjth7jIlXhl%F5n?e#>Nu||J zn2!$CXIs$*jkQUx9Vcw-ZAovAEKYyg()qcHuD6Ya;`D%KeYiJ;RowIN-hv_^Bj^&W zmz0}EiUqz*PO2lKa{Q?@@W35sZa(xIA6TqZ?X(rT0AJ0-4xL)`{Z&(4r*W6^Jl9D2 zhNTbjcx)dT6WS<{_%H0x8kOqcyMxr@SWC9u-C!K#S$%@Mj z!13GPa#eK4#yL4EvM-aL+~t-Em$dscbFq9_I2|^fFcU{&`p7Kehcud;#g!Y^fy#kA zh8y#?2X>SgqLvu+WbV|6TBURBX({GN{QypdjauJ9cCtYnRY6e2d^eU|{D|!fkT888 zib2zeRsa42oWnYQyqWKOQORPIoEIcZi4E;En;F3RM5x_;JQTL?2%0`9I_+|JVjuKc~;{xy`dSJ#GdJ-_iIU3t>sfBZTi}fZ2JDBg1z*XSn5PXtULFa#?2gqbwdzYvk z+Rr^YRD;=tMm<@s{A4IxPP`iqtKOT=ZOG@sFJ^jnupTZ-UAQw<5Mr@Ms1JP2T04)g zvH0KDF@rkW3aWoB@WUUv3k6-ZF&2R?%w4@lynoPW1M2yvR2lOAPIw0J#&QUObEP%Z(i4 z)mS%jG-c7VvJqs__r+YNni@9So@NrC<#WL%wcj$(&lhLz&} zAQXUYgzo-GI4SpYxx+TgQ#;;)Crd z)oMzon#t4RmZn%%YKzy*euq%2mNuXS3+gj6WIcZwdKrKFd0BwhKIOI58tF{m455H( z3m!zcY;ak;`bAufY3*DxY1wj#_@_^*s^9bxU~1#zI+iZckFP{%`nh&>c2dZ6v~E{; z{Hd4q8#MP8uJS81DibWeiE;5D4vb|U^pw)E%TAhiC2u3}wLh$t6ElcmXG4>0g$u)v zJtUSV(c6D@0z{+9@rO+|ff>B=&e_J&pC|~&WNu}Z%C!e-`RZMuW*W(I=vx1K(n@0W zowg34XVX`#MJ)3~4Ux5&sHR@pvH&+J0Hl8Hjt?l^rCfOs0;@@>SP%qgG{T~f&+?Jl zw2tG)3Z~<=2tm)#DNYIf80^B!GlLDe%9B?^b&`KLe~GMq))>XA5#3uAtP9y4%;|If zG;74=+}sOsYqEdjzt^Fl!d6%kK<`nCJcEP2v*8c+YbRqP54IO=%|?BfUb z#Ht^asaHztHUUPj;OY`eA6~usaj<43kG2aAp{i0>8pTEYb2QMY-lVg^96zvDoe-$R zwcvl@FAcG75;E(~oZk<2J~=n8iDpm60I|B3c3ZouzJBU6w2<>g;fJ0wVNFtRh4FdT z%Rx1hYEK@eS>p7OR^BVW&QdbelbxiazB#5RZ-?*fMvx-x`K9cmhN-g=dII30DXsBN z$9VTtNG03mPbespBIDle>X=JEu%9*w>r8*l(WQUS+$G5^#Y~lm&tYt_rspz4LsTfG zOHBpn7cuO<=4zr8)^XMXP(@K)PcRKCseC|;Z5WjZeYV2B9 z1P1bsc{{f+WThuKmu^;KzdBdw_6vWb0)G0ZNY>9FLFivdvi5srB&(llk^K4=oC}1- z_}M1rMAo(=X@5Jbh1za6g6}-f;@?$ix*l5X*=Gi|AwBw7FFLc`3Z=T1e>fcN1&3bq zn@coh9C}mcZd4-|f}HkHC~n1@#D1(}h6Bl2A@@%Q@N}!Lf3&zv*75mS4kmxC@I}oA zzj2|SDP9yv;DYAVi5P$nz|=b-gw93E9h7@!U8}NDXm)2g@Mz`$C_E~pf2sbe$VNxNWg7CwD5uTlTd647vCxxS`5^~+i%3oo$<=Ut7 z96^zpSju@r$84gNVErKYNtV0q%r!bu0bINIX>{=o{Yo;qIe}jww@|a@ui(dgepJ8kd7lOaQD49BSZNR~ob$&O zk7x0cF9b%YM6(;R& z>c*G%1)}{X$%f_0t8V_&LNQU|0xkI3^#2v9Vh5%nhr zdsYmeWIv&B_#`cG{+tpJXY%zh<=zWf`~HA8b=FeEgQU!~(4G ztKp3!X7^z8TDs_-``@hRMC~tFi0__dxX*0}y=Ku+K_v3MQFss)6Mo3)N80o-GGc*W zqtL?nMDyA^8LxWo6s#(8BiGE*b(LJ80%S2I&;7tsS(Iud<2!Pq_7 z>J=D1|4`9nwAA=Bq*ee8T-oXYHqazGaBBxrAXf*xG306XETw{w1^@SbxoZrvB@7;< zIy#$$kn-oXcBOFb)gkUIjST)S6{Ak92W>iRfVl+>usEb%U`2m36mhpc(00T)sv9GL zZ$jfE=kcjZc;`J2HCB6CQ+Eo7vSpHPUfWuethbwDt_0oBbK8itz))(CMpr(R5B)?P zr~DX{n}1`D_WP?4W03usm03LnEe=atcZtA`B*4ji@MFI(hQ39`@cD~Jm?|Q>hp}MW zBP@1lTH|X@8(n|F3|tdOGU;dyMo*r%EEoj4(AO?W6L_WzK@B8a=dAk*lyd}Y<7RD8 zDR_+ERe&|!dTY>%hp9MP7c&=^FE3G%ga}k|^ApCxZyug=Q~wXW5j~F7WcH?x(18$d$?BpD-!$GC$eMt*93*}cRz@aC95vE zbo>Sjw~sSB?w+EcFhyjs5{!UFV^-YTX%vVAhx>n^P-^UJXp-RJAa8XB*qyRCj4cb- zRtI9BFx%wgz?Us z>oeetM}}cMV%1rd6J2x=wbRcLN|8R~st2r>ihqh38kECo?4fkJ)xNFJY}~=Z($G^E zA4-3tRMmld%nq7rkiC7%j-v#>2eMo|rUrNcT5$ea>7}Xj%0nMK0{lqoAh{EZWMFU2 z?!>~Mgb!SzeS4;xt}k}YQPqtxR@Yn-@Hk5Wx~hyDCk?gu)|OLkjL1s{>wRy@#2VmJ znoX1$=4b9mXv3K@I|f|Vd$T-lnF@i5Gpv7p{faHOI1{2$$;VcAM3>05@M7iAS`rs$ z*>pBhPp@>$(p>6^lmSApfZ%ati8_sF%z5n?;Gd^})wsAe;;qNqGJ5EEVj_h^rjoiWJAij^KT^KiemaQ*LCt~Vc3%5HuZn3TM|`;hAj3=a2h^{>eVrKIz$R}Fvl zJmCbxlRb|8U1EGj>#%#?-0qpbg5%1jjtN{&7vZS1JWUwzOU*9CNd2I*Bh-IfF^e%EmB7aaH-T0k*XL=`2^+C)>&jSZDe07V z|I4%HQH%Z1cDBB=vQ{6O*i<~L$P2-tsvZF+z6@(L<9ULG}>YN;%*B} zo&7)}<#)+(z{3{ma15xSj5$<%gE8F$A`EY_1d*@2ih?hm5)@&g{7Mb)ksyDSG8&tf zy48HrJ=34^yU*BnZ-6)`d`kR{RlA-@FbKSdbT#z*a`oMRyDQ}(Y!Qz!7PXIi?fNU+8JZJq?OJ9`gFo!Nn# zJCbbf)Pv82Lg$-wQ^T0FuBCqjsZnQZ_=7L}nJGtg^kAfH_h>wCtmB=X(v5|JM&@4J z*!#O;?Iq-XrN~m6R?p#9m)=}89sSH4jHKB;+L4A}Oi}=aCpZbb)W4d$ycoK`a@(&nXPD_7-8se;v2?#i@ z5|D*$W`hvY#F2L^dgS||;U-%m<8vK$+$eenj(YkZGz`+!`utjH=I*+sSFly$5KZK- zFSX4GPUe4~V!<7M_@B_sv@R4UoRo~)Ch$#3{30wRJ}2$##*6+N0F0Nv8NK-)mpX% z@4ostl_4ISiSl`rqt%-|_XE@aqA8<&YKiWy4$Z;oCpZ5nke+|c+~anTHd3P{mchxm ziE75=L4LzN-xtubZ8rc8A5+5}2#^ait_(WiB%^Z9ZWf=I=!O~HFS36eL^p6)v7Y5I zHz=sWEy^;s*M!^Fc)G|#SVGq}IHPJQOMBumSC^kVQ=~>gBr+a+Rq^?u{AGuFAQC@k zga)8!>>xqoC)nH6A<3~Y3s`@$#AV!Yr@k@`^o)oX>E1sT~Ag1wYDw5<6 zKV?q$Z-+AvG4p83!1rXSjAb!yr3$w4j0RBTz~66KXsds>x#XDMYi3=pj>usTFx|%e z2eODYW|KtQ`#XAByPJWfo?Pl>Y`FFf85H$>vVpi1+tlTD%@T}rSh`0Qj&hHNA4Y?| zOPd^d=-Zj_qh z)daLS3Q_pFP7FV!9CMWn*||txn|zMf8}{Jbz&sV9Q4sV%qUMzf@94TQ9jiR|;Qyr6 zb5g1e=SHGl^<8Y;LJ>?l!$^!hP=4 zWm$j!_x{)#<)ro~78OK;d#S{RBNWNJ;i?W`h9Q=9m(#`#uhmanl9}D7KVW!QHs`I- zt_jMk?j3^zaB9wh8rlvdeMQfNAe?3OXp#e_MLJ>nJ;)IVeyYZ8MSt`=*@GH-9sr@< zs-P+(o5bz0Fg`FLFbM_)D-Ht!8U+9Z6xYT>#LaQo(*VtnzN_qMP4M!Fhy)b<1nu-# X_d}DEK0Izji}dfgHE9+C0|ADh?iv+(