x509: <certname> certificate is not trusted error on MacOS 13

[potto007]

Summary:

When attempting to login to sshd via a ziti tunnel from MacOS, receives a "certificate not trusted" error.

Steps to reproduce:

1. Create a client identity
2. Download the client's jwt to MacOS
3. Run zssh enroll -c ~/.ziti -v ~/Downloads/zsshClient.jwt -o ~/.ziti/zssh.json
4. Run zssh -d -i ~/.ssh/<pemfile> ec2-user@zsshServer

Expected results:

INFO 	      username set to: ec2-user
INFO 	targetIdentity set to: zsshServer
connected.

Actual results:

INFO 	      username set to: ec2-user
INFO 	targetIdentity set to: zsshServer
INFO 	connection to edge router using api session token da064f00-5cb8-4a92-bc73-84339e75bc13
ERROR	x509: “i-07fab813c818929f6-signing-intermediate” certificate is not trusted

Details:

I spent a couple of days familiarizing myself with the sdk codebase responsible for enrollment and for connection. I setup a debugger config in Jetbrains Goland to replay the events leading up to failure. I found that the Go std library was where the error was being thrown, due to the cert's signer not being recognized. Reading through the enrollment codebase, it appeared that remote CAs should be pulled down, but were only pulled when the client specified custom CAs. Given the behavior on Windows, and the behavior of the Ziti Desktop Edge client - whereby the zero trust PKI is inherently trusted - I changed the local copy of [email protected]/ziti/enroll/enroll.go to always pull down the CA bundle during enrollment. This immediately fixed the issue I was observing. Upon preparing to create a PR for sdk-golang, I found the same thing I had done was already performed a month ago with this commit: openziti/sdk-golang@574fcf1 made with this PR openziti/sdk-golang#342. Given that fix, I merely had to update zssh to pull in the latest versions of the dependencies.

Fixed by:

#24

[dovholuknf]

closes #24

[dovholuknf]

don't know if you use the released versions or build yourself. new tag here with binaries: https://github.com/openziti-test-kitchen/zssh/releases/tag/0.0.15

[potto007]

Thanks! I try to use released versions of projects when I can, and definitely need to before I demo this environment for architecture review.