Android certificate provisioner - Certificate is not ASN1 encoded

[stegar123]

PacketFence version
pf 15.0
rockylinux 8

Describe the bug
When I try to press the button "configure" on android packetfence client I see a lot of information like:

Sep 12 08:57:29 localhost httpd.portal-docker-wrapper[6849]: httpd.portal(17) INFO: [mac:16:c0:a8:db:c2:21] Certificate is not ASN1 encoded. Trying next encoding. (pf::ssl::x509_from_string)
Sep 12 08:57:29 localhost httpd.portal-docker-wrapper[6849]: httpd.portal(17) INFO: [mac:16:c0:a8:db:c2:21] Certificate is not ASN1 encoded. Trying next encoding. (pf::ssl::x509_from_string)

Approximatively 1 of 10 times I had to press the button "configure" to to be able to install the certificates on my android.

[JeGoi]

Looks like related to:

[root@localhost ~]# grep "Trying next encoding" -r /usr/local/pf/
/usr/local/pf/lib/pf/ssl.pm:            get_logger->info("Certificate is not $encoding_str encoded. Trying next encoding.");

This function is used in:

[root@localhost ~]# grep "x509_from_string" -r /usr/local/pf/
/usr/local/pf/lib/pf/UnifiedApi/Controller/Config/Certificates.pm:        $cert = pf::ssl::x509_from_string($data->{certificate}) or die "Failed to parse server certificate\n";
/usr/local/pf/lib/pf/UnifiedApi/Controller/Config/Certificates.pm:            @intermediate_cas = map { pf::ssl::x509_from_string($_) or die "Failed to parse one of the certificate CAs\n" } @{$data->{intermediate_cas}};
/usr/local/pf/lib/pf/UnifiedApi/Controller/Config/Certificates.pm:                my $x509 = pf::ssl::x509_from_string($t) or die "Failed to parse CA certificate\n";
/usr/local/pf/lib/pf/UnifiedApi/Controller/Config/Certificates.pm:            my $x509 = pf::ssl::x509_from_string($t);
/usr/local/pf/lib/pf/cmd/pf/renew_lets_encrypt.pm:        my $old_cert = pf::ssl::x509_from_string($cert_str);
/usr/local/pf/lib/pf/ssl.pm:        my $inter = x509_from_string($cert);
/usr/local/pf/lib/pf/services/manager/radiusd_child.pm:use pf::ssl qw(x509_from_string cn_from_dn);
/usr/local/pf/lib/pf/services/manager/radiusd_child.pm:                    my $mcert = pf::ssl::x509_from_string($cert);
/usr/local/pf/lib/pf/ssl/lets_encrypt.pm:    my $x509 = pf::ssl::x509_from_string($data);

It does not look like a stop for now. Need to investigate who is returning that but since there is no subsequent issue, I guess the "Trying next encoding" has been a success.

Need more info but do not think it is a stop.

[JeGoi]

Found the culprit:

Sep 17 14:26:33 localhost httpd.portal-docker-wrapper[1263326]: httpd.portal(13) INFO: [mac:16:c0:a8:db:c2:21] Certificate from 'certificate #1 from file: /usr/local/pf/conf/ssl/radius_default_tls-eap-fas
t.pem' is not ASN1 encoded. Error: Crypt::OpenSSL::X509: failed to read X509 certificate. at /usr/local/pf/lib/pf/ssl.pm line 105. 

[JeGoi]

Uncle said:

The file radius_default_tls-eap-fast.pem is created at line 1611 or 1620 in radiusd_child.pm.
The .pem file is supposed to contain  the CA certificate. Looking at the code, when it's a
symlink (line 1611) it points to $cert{$key}{$tls}{ca}, and when it's generated from template
(line 1620) it uses $vars{'ca'}.
The problem is that the code at line 1642 is trying to read .pem files but the validation code
is looking for .crt and .pem extensions.

What's happening with the CA certificate:
The issue is that this code is trying to validate that certificates match their keys, but it's
reading both .crt files (which contain the server certificates) and .pem files (which contain
CA certificates). The .pem file contains CA certificates that won't match the server's private
key, which is expected.
The problem is that when x509_from_string fails to parse a certificate from the .pem file,
it returns undef, and then line 1651 tries to call validate_cert_key_match with undef, which
would cause issues.