Subject comparing about sscep

[mbartosch]

I am afraid I do not understand the problem properly.
Does sscep terminate after finding a difference? Reading the code (master and develop differ a bit) seems to indicate that the program might complain about a difference (when called with -v) but continue anyway. This is correct in my opinion, because the CA should be able to modify the scep request to match its policies.

So if the program complains about differing subjects but continues anyway you should be fine.
If it terminates, this is an error and should be fixed (but as far as I can see it should not).

[nikedlab]

May be it is OpenSsl issue when executed X509_NAME_cmp(). I need to find matches in certificate subject:
"(/C=US/ST=Qwerty/L=Asdfg/O=Test organization/CN=Test User)" with subject from CSR: "(/CN=Test User)" but X509_NAME_cmp() returned not zero.
As workaround now I use strstr(cert_buf, req_buf) to find my CN in certificate subject as substring but I think it is not best way

[mbartosch]

I understand you actually WANT to match the cert subject against the csr subject? I don't know why this would be useful (in fact it can cause a lot of trouble, which is why the original check was removed from the sscep code).

Your problem is very likely caused by a nasty side effect of the OpenSSL X509_NAME_cmp() function: even if the string representation of a subject looks exactly the same, the corresponding DER representation does not necessarily have to match. For example, I had the problem that the request contained a BMPString with the requested subject. The CA then returned a certificate with the exact same subject, but encoded as IA5String (or vice versa). The OpenSSL compare function considers the string as different even if their ASCII representation is identical.
Alone for this reason it's not really useful to rely on DN matching - IMO, that is.

[nikedlab]

Ok, I understood. Best solution it is to disable subject comparison. I'm right?

[mbartosch]

In my opinion and from my experience designing and developing PKI solutions (OpenXPKI and CertNanny) I think it is best to disable it - it does hurt more than help.