Letsencrypt started signing their CA certificates (current Root YE and intermediates YE1 and YE1) with ED25519 and ED448, neither of which are supported in VyOS PKI, so importing those new LE CA's into the VyOS PKI is impossible, which makes impossible using LE-issued certificates on the HAPROXY loadbalancer.
This impacts production, currently we have patched pki.py on our routers, but I reckon it needs a more permanent fix.
The fix is simple and goes into pki.py:
def verify_certificate(cert, ca_cert):
# Verify certificate was signed by specified CA
if ca_cert.subject != cert.issuer:
return False
ca_public_key = ca_cert.public_key()
try:
if isinstance(ca_public_key, rsa.RSAPublicKeyWithSerialization):
ca_public_key.verify(
cert.signature,
cert.tbs_certificate_bytes,
padding=padding.PKCS1v15(),
algorithm=cert.signature_hash_algorithm)
elif isinstance(ca_public_key, dsa.DSAPublicKeyWithSerialization):
ca_public_key.verify(
cert.signature,
cert.tbs_certificate_bytes,
algorithm=cert.signature_hash_algorithm)
elif isinstance(ca_public_key, ec.EllipticCurvePublicKeyWithSerialization):
ca_public_key.verify(
cert.signature,
cert.tbs_certificate_bytes,
signature_algorithm=ec.ECDSA(cert.signature_hash_algorithm))
elif isinstance(ca_public_key, ed25519.Ed25519PublicKey):
ca_public_key.verify(
cert.signature,
cert.tbs_certificate_bytes)
elif isinstance(ca_public_key, ed448.Ed448PublicKey):
ca_public_key.verify(
cert.signature,
cert.tbs_certificate_bytes)
else:
return False # We cannot verify it
return True
except InvalidSignature:
return False
def verify_crl(crl, ca_cert):
# Verify CRL was signed by specified CA
if ca_cert.subject != crl.issuer:
return False
ca_public_key = ca_cert.public_key()
try:
if isinstance(ca_public_key, rsa.RSAPublicKeyWithSerialization):
ca_public_key.verify(
crl.signature,
crl.tbs_certlist_bytes,
padding=padding.PKCS1v15(),
algorithm=crl.signature_hash_algorithm)
elif isinstance(ca_public_key, dsa.DSAPublicKeyWithSerialization):
ca_public_key.verify(
crl.signature,
crl.tbs_certlist_bytes,
algorithm=crl.signature_hash_algorithm)
elif isinstance(ca_public_key, ec.EllipticCurvePublicKeyWithSerialization):
ca_public_key.verify(
crl.signature,
crl.tbs_certlist_bytes,
signature_algorithm=ec.ECDSA(crl.signature_hash_algorithm))
elif isinstance(ca_public_key, ed25519.Ed25519PublicKey):
ca_public_key.verify(
crl.signature,
crl.tbs_certlist_bytes)
elif isinstance(ca_public_key, ed448.Ed448PublicKey):
ca_public_key.verify(
crl.signature,
crl.tbs_certlist_bytes)
else:
return False # We cannot verify it
return True
except InvalidSignature:
return False