Problem with signed tcl scripts

Question

Hi All,
Im having some difficulties getting signed scripts to work on a router.
Ive got openssl 0.9.8h installed on a FreeBSD 6.2 box, and following the documentation located below, word for word, I cant seem to get any scripts to run properly. The router just seems to continually fail to verify the digital signature.
http://www.cisco.com/en/US/docs/ios/12_4t/netmgmt/configuration/guide/sign_tcl.html#wp1079441
When trying to run a script I usually end up with the following error messages:
Invalid Signature
May 10 04:54:30.845: ../cert-c/source/p7spprt.c(614) : E_VERIFY_ASN_SIGNATURE : error verifying digital signature
May 10 04:54:30.849: CRYPTO_PKI: status = 0x725(E_VERIFY_ASN_SIGNATURE : error verifying digital signature): pkcs7 verify data returned status
May 10 04:54:30.849: CRYPTO_PKI: status = 0x725(E_VERIFY_ASN_SIGNATURE : error verifying digital signature): failed to verify
May 10 04:54:30.849: CRYPTO_PKI: unlocked trustpoint scriptsigning, refcount is 0
May 10 04:54:30.849: %SYS-6-SCRIPTING_TCL_INVALID_OR_MISSING_SIGNATURE: tcl signing validation failed on script signed with trustpoint name scriptsigning, cannot run the signed TCL script.
But when I try signing the example script in the document mentioned above it seems to work fine:
#tclsh flash:hello.tcl
hello
argc = 0
argv =
argv0 = flash:hello.tcl
tcl_interactive = 0
May 10 03:58:00.408: CRYPTO_PKI: self-signed cert within the pkcs7.
May 10 03:58:00.408: CRYPTO_PKI: Added x509 peer certificate - (1073) bytes
May 10 03:58:00.408: CRYPTO_PKI: chain received from the peer has been reduced to one already trusted cert
May 10 03:58:00.408: CRYPTO_PKI: validation path has 0 certs
May 10 03:58:00.408: CRYPTO_PKI: unable to get cert attributesfor AAA list authorization.
May 10 03:58:00.408: CRYPTO_PKI: chain cert was anchored to trustpoint scriptsigning, and chain validation result was: CRYPTO_VALID_CERT
May 10 03:58:00.412: CRYPTO_PKI: Success on PKCS7 verify!
May 10 03:58:00.412: CRYPTO_PKI: unlocked trustpoint scriptsigning, refcount is 0
In both cases I used the exact same private key and CA certificate to sign both scripts.
Does anyone have any clues, tips, or pointers for doing this successfully?
Cheers,
Tom

Answer 1

I found your problem. The ORIGINAL script ended in a blank line. Therefore, you need TWO lines before the signature. I took the pkcs7 file you sent, your latest cert, and then added the signature to a clean btest.tcl with a trailing newline. The result worked perfectly.
I'm attaching the signed btest.tcl along with the exact same cert and pkcs7 file you sent (I'm not attaching the private key for obvious reasons, but it is the same).
All I did was take your pkcs7 file and:
xxd -ps btest_sig.tcl.pk7 > btest.hex
(I added a newline to the top of btest.hex, added the signature header, and commented each subsequent line)
cat btest.tcl btest.hex > btest_sig.tcl
I loaded your cert into my router, then loaded the signed script:
Loading btest_sig.tcl from 14.32.100.33 (via FastEthernet0/0): !
[OK - 5618 bytes]
Bandwidth is 8434.