{error,enoent} when private key is in system ca-certificates

[weisslj]

Describe the bug
From an experiment with mitmproxy I had a private key in my /etc/ssl/certs/ca-certificates.crt. Up until now it worked well, but with Elixir >= 1.17 I get a nasty crash in mix, see elixir-lang/elixir#14322 for that. It took a while to debug because despite a parse error OTP returns:

1> pubkey_os_cacerts:load().
{error,enoent}

This is misleading, better would be {error,wrong_format} or something like that. This is due to a "catchall" in the implementation.

To Reproduce
Copy broken-ca-certificates-minimal.crt.txt to e.g. /etc/ssl/certs/ca-certificates.crt, and execute function above.

Expected behavior
An error message that does not say "file not found". Or just skip over the private key, like all other libraries seem to do.

Affected versions
OTP >= 25

[weisslj]

Here the file to reproduce: broken-ca-certificates-minimal.crt.txt

Related issues:

• [public_key] Dedicated error on missing cacerts file #7295
• pubkey_os_cacerts:get() fails when no CA certs are installed #7321

[IngelaAndin]

Although I think it is a very unexpected and strange thing to do (not wise from a security perspective), to add a private key to the ca-cert file, it could be reasonable to ignore the key entry, ssl will do that if the ca-cert-file is added as cacertfile-option. But probably it would in this particular case be good to have an error or at least log to make the user aware of that this is a bad idea. I think it is always a bad idea but when using more customized files they might be better protected. But os-cacert-file is suppose to have public information only.

[weisslj]

@IngelaAndin Yes, I agree, a private certificates in a ca-cert file is of course bad. It was just from a local experiment with mitmproxy. I think it would be better to ignore it (but warning sounds good), as it is in line in what other SSL libraries do. But even error would be fine for me. What is not good in my opinion is returning enoent on any parse error, like it is now (because of this error atom it took me quite some time to find the root cause).