certificate path: found duplicate certificates (AndroidKey

[transon12]

dear @MasterKale

Describe the issue

Reproduction Steps

I have an issue as follows:
I'm currently using SimpleWebAuthn version 11.

Back in January 2025, I used a Samsung S9+ running Android 10 to successfully create a passkey on my website.

However, today I'm using the same device to create a new passkey for a different account on the same website, but I'm now getting the following error:

certificate path: found duplicate certificates (AndroidKey)

I have tried debugging but haven't found the root cause yet.
During this time, I only updated the AAGUID values according to the library but did not change any of my code.

Dependencies

• OS: android 10
• Browser: Chrome
• Authenticator: Samsung S9+ Android 10

[MasterKale]

Hello @transon12, please share some sample code of how you're using SimpleWebAuthn, including the WebAuthn response you're trying to verify that's causing this error.

[transon12]

try {

  // Confirm where the generated key
  const fullUrl = event?.headers?.origin || process.env.WF_DOMAIN
  const parsedUrl = new URL(fullUrl)
  const hostname = parsedUrl.hostname

  const verification = await verifyRegistrationResponse({
    response: passkey,
    expectedChallenge: currentChallenge.activation_key,
    expectedOrigin: fullUrl,
    expectedRPID: hostname,
    requireUserVerification: false,
  })
  return utility.createResponse(true)
} catch (error) {
  console.log(error)
  return utility.createResponseAndLog(event, error, null, [errorMessageCodeConstant.SYSTEM_ERROR])
}

At the moment, I'm processing it this way, and the error is being thrown and caught in the catch block.
Error message content:
{"message":"Invalid certificate path: found duplicate certificates (AndroidKey)","data":{}}
@MasterKale

[MasterKale]

I'll need the value of passkey to get anywhere with this one as it's the response out of the WebAuthn API call that contains the attestation statement that ends up with duplicated certificates.

[transon12]

dear @MasterKale
passkey value
"passkey": { "id": "AZNJEB2RcdcMJ0kZ1X1lyA6d7ENiKF5K945bpbZXxdVqoyjENSnHSZuxZz9sBMVyKAArpVBhwWr7WTutT_epNsk", "rawId": "AZNJEB2RcdcMJ0kZ1X1lyA6d7ENiKF5K945bpbZXxdVqoyjENSnHSZuxZz9sBMVyKAArpVBhwWr7WTutT_epNsk", "response": { "attestationObject": "o2NmbXRrYW5kcm9pZC1rZXlnYXR0U3RtdKNjYWxnJmNzaWdYRzBFAiBN6uMvi4Arrog6bM-EH_HHdcYowZb9AZ3OP8LF7BsOwQIhAIGMW51yybiu_p90i60qFilQ2NTBfNSKMxWSd-_ElLGGY3g1Y4RZAsAwggK8MIICYqADAgECAgEBMAoGCCqGSM49BAMCMCkxGTAXBgNVBAUTEDljZmFiZjY5ZWNjMzc0OWMxDDAKBgNVBAwMA1RFRTAgFw03MDAxMDEwMDAwMDBaGA8yMTA2MDIwNzA2MjgxNVowHzEdMBsGA1UEAwwUQW5kcm9pZCBLZXlzdG9yZSBLZXkwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARF-xUruvQrCRWHiRDV4Lsq4FjoEpLFf361IEQaaeBsGuz0zt29H0BKNbEIUpvWcuKBKwmcOvMH2wFAZ7tRHblHo4IBgTCCAX0wDgYDVR0PAQH_BAQDAgeAMIIBaQYKKwYBBAHWeQIBEQSCAVkwggFVAgEDCgEBAgEECgEBBCCtDPAKpMZ9hMbYOO1XIwN-v_gVMOTGAjDefrroBsj2-QQAMHe_hT0IAgYBl_krnvi_hUVnBGUwYzE9MBsEFmNvbS5nb29nbGUuYW5kcm9pZC5nc2YCAR4wHgQWY29tLmdvb2dsZS5hbmRyb2lkLmdtcwIEDwvKrjEiBCDw_WxbQQ8lyyXDtTNGyJcvrjD47nQR35EEgK1rLWDbgzCBqaEFMQMCAQKiAwIBA6MEAgIBAKUFMQMCAQSqAwIBAb-DeAMCAQO_g3kDAgEKv4U-AwIBAL-FQEwwSgQg2O2bmq25z_lUP96p1NX4bjoeGqNeSEFetzrqoDDefYEBAf8KAQAEIG_Q-U6jhMM6Kdz7OeX58NCiyMveuzh_N9gbNCMAB8_rv4VBBQIDAa2wv4VCBQIDAxV_v4VOBgIEATRlnb-FTwYCBAE0ZZ0wCgYIKoZIzj0EAwIDSAAwRQIgLy0SGjDM7BDO9xLfOjfHkYMiKMeY0CZ1SBs-lsAPSqcCIQDpxwWdHetnjLhMJrd6HGw88aI5-GZlO9_7mpNWu94r7lkCKDCCAiQwggGroAMCAQICCgNwFmEVJQaTJJAwCgYIKoZIzj0EAwIwKTEZMBcGA1UEBRMQMjg1ZjdmYTllZWIxNDAxNDEMMAoGA1UEDAwDVEVFMB4XDTE5MDYxMzE5MzExOFoXDTI5MDYxMDE5MzExOFowKTEZMBcGA1UEBRMQOWNmYWJmNjllY2MzNzQ5YzEMMAoGA1UEDAwDVEVFMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE0ZjVvvE-xQefNwWt2g0fjCzKcCGErvUUla1Sy0YRXGTUPW_xZg7OpoWB1XFfFlgM-1xih8UmDGpFF77KX2WHtqOBujCBtzAdBgNVHQ4EFgQUQHGUFV40EuDlHb86QZ6X74Rv1GswHwYDVR0jBBgwFoAUZsclWZX-WiRVCJ2uL-JyioxCRzowDwYDVR0TAQH_BAUwAwEB_zAOBgNVHQ8BAf8EBAMCAgQwVAYDVR0fBE0wSzBJoEegRYZDaHR0cHM6Ly9hbmRyb2lkLmdvb2dsZWFwaXMuY29tL2F0dGVzdGF0aW9uL2NybC8wMzcwMTY2MTE1MjUwNjkzMjQ5MDAKBggqhkjOPQQDAgNnADBkAjAay0bXweDTEiM5h3qEFZh0lvjfm7BrD6PdwSgHiMSoln9Lp1Y6dtdMifLSuqTSPp4CMASAp7BEH6DBT-B6S3MnpAz-pS_BPAZDgYr8rFH2tnlMM1WOEtjQIQ2KfodC4tJU81kD1TCCA9EwggG5oAMCAQICCgOIJmdgZYmWheIwDQYJKoZIhvcNAQELBQAwGzEZMBcGA1UEBRMQZjkyMDA5ZTg1M2I2YjA0NTAeFw0xOTA2MTMxOTI1MjhaFw0yOTA2MTAxOTI1MjhaMCkxGTAXBgNVBAUTEDI4NWY3ZmE5ZWViMTQwMTQxDDAKBgNVBAwMA1RFRTB2MBAGByqGSM49AgEGBSuBBAAiA2IABAUTSmkto8xjo3bsJ2VyoiU24xF1pA1wLmmqy6_rD60WMB4I3fU73p-NXVdQ720JSXel8O0-BH0kOQaGkQytYLXFnN7IcWfeQp1weEZpd8IbUPiN8gTUyl1Y0GCKSBL-kqOBtjCBszAdBgNVHQ4EFgQUZsclWZX-WiRVCJ2uL-JyioxCRzowHwYDVR0jBBgwFoAUNmHhAHyIBQlRi0RsR_8aTMnqTxIwDwYDVR0TAQH_BAUwAwEB_zAOBgNVHQ8BAf8EBAMCAgQwUAYDVR0fBEkwRzBFoEOgQYY_aHR0cHM6Ly9hbmRyb2lkLmdvb2dsZWFwaXMuY29tL2F0dGVzdGF0aW9uL2NybC9FOEZBMTk2MzE0RDJGQTE4MA0GCSqGSIb3DQEBCwUAA4ICAQBsKTstdjFUeQ1dVLRyx9ecE5qQaZV26Bos7boyz-R2HJv4iJ492aii9FLVwLei2c-aVgHuAKIfht3kP25-0crEoFKc0AiBzX3LS9a7P3V4tt8z-kBiKQkJtcbEw9r2HlTDviEa7GCRvLbFoORFyTZjQTR5tJQQEhYrsB5qo-vVweHZ_uQ_KR_Ag5DzNGPh_KFXwz-qVh720Ca99wixT4wMgGFIgIZxTIAz8c3kDYXqQ5j4jplksQbghTSN5lnKPeVjZpc_dga4r09bpm61z2ylNybUnBwUnkpRyzNVRlpZRpd0yq7royq_QRI-zoZd4nx--1_AqC3XshBfmSz9Dxxx8aNQ0QR3WJtLtya9ECxmyLh9LqNbCgoRSLi4g8sDLkIy9yaY7goL7XVdFZfTDKiwne-BsjD6Fgl7yFmCkndJMvJjVD0r4WaoFB-Tomx0eg7Lgdy2sJs5T_Yo-woGvn2qPGFsbm1oib4MgnsK2JtjH9VmfB2oUQ16sLWSVaqMHtSx1ZB2FxyB1auRs-sNeNxhAkLw4D-6R8j7Rug3sXoV4p14UL7KvjL8p2th7CImGvgUHRJ_EUhpEl6Rc8XLPeHi64Qw7POnha8oSaZFpHkSR2oGDKkHVcqUBz3KFizVh15du40fpq2TYtH4of_hJlUzEtH2Uidou3WyNtSjhNQq7VkFZDCCBWAwggNIoAMCAQICCQDo-hljFNL6GDANBgkqhkiG9w0BAQsFADAbMRkwFwYDVQQFExBmOTIwMDllODUzYjZiMDQ1MB4XDTE2MDUyNjE2Mjg1MloXDTI2MDUyNDE2Mjg1MlowGzEZMBcGA1UEBRMQZjkyMDA5ZTg1M2I2YjA0NTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK-2x4IrsacB7Cu0LovMVBZjq--YLzLHf3UxAwyXUksbX-gJ-8cqqUUfdDy9mm8TNXRKpV539rasNTXuF8JeY5UX3ZyS5jdKU8v-JY-P-7b9EpN4oipMqZxFLUelnzIB9EGXyhzNfnYvsvUxUbb-sv_9K2_k_lvGvZ7DS_4II52q_OuOtajtKzrNnF46d5DhtRRCeTFZhZgRrZ6yqWu916V8k6kcQfzNJ9Z_1vZxqguBUmGtOE-jeUSGRgTds9jE-SChmxZWwvFK1tA8VuwGCJkEHB7Rpf5tNEC1VrrR0KFSWJxT5V03B2LwEi7vkYYbGw5sTICSdJnA6b7AuD47wfk8csBJYEu9LxNF5iw_jibb7AbJR2bzwSgjnU9DEvrYEjiH4Gvs9WdYO_g1WoH-6rr5moPI3z4qMir8ZyvxILE1FYtoIc6vMJtu7nf5iDOwGNqhDkUfBqN01QeB81kIKWa7d4uTCJQmmOdOC80kYooBwswD5R8LPltKweTfnq-f9qSSp3wUg4gohQFbQizme4C4jJtI4TtgerVFxyP_jET48tNoufZSDTEUXr-ehirXHfajv9JFCVnWU3QNl6EvNosT72bV0KVKbi9dmm_vRGgyvGeERyWGHwk90ObzQF2olkPvD01ptkIAUf25MElnPjaVBYDTzfT70IvFhIOVJgBjAgMBAAGjgaYwgaMwHQYDVR0OBBYEFDZh4QB8iAUJUYtEbEf_GkzJ6k8SMB8GA1UdIwQYMBaAFDZh4QB8iAUJUYtEbEf_GkzJ6k8SMA8GA1UdEwEB_wQFMAMBAf8wDgYDVR0PAQH_BAQDAgGGMEAGA1UdHwQ5MDcwNaAzoDGGL2h0dHBzOi8vYW5kcm9pZC5nb29nbGVhcGlzLmNvbS9hdHRlc3RhdGlvbi9jcmwvMA0GCSqGSIb3DQEBCwUAA4ICAQAgyMONS9ypVxtGjIkv_3KqxvhEoR1BqPBzbMN9FtZCbY5-lAcETOo55osHwT2_FQPdXIW9r7LALV9s2076gSffiwTxgncPxOd0W3_OqocSmogBzo6bwMuWN5tNJqgtMP2cL47tbcG-L4S2ieTZFCWLFEu65iShxwZxEy4vBhaohLKk1qRv-om2Ar-62AwSQ3EfVutgVvY3yKAUHMVAlCaLjDx9uZSzXA3NbLKrwtr-4lICPS3qDNbDaL6j5kFIhvax5Ytb18cwsmjE48H7ZCS5H-u9uAxYbiroNoyE1dEJF72iVheJ1GhzkzQOLiVPVg72SyNY_NwPv8ZwCVLnCL_8xidQDB9m6B6hfAmNei6bGIAberSscVh9NF3MgwnVtipQQnqm0D3LBZlslroMXXHpIWLAFsqEn_NfDVLGXQVgWkfzrpF6zS35EO_SMmaIWW72mzv1_jFU9664gKCnPKBNlMLOgxfutD1e_1iD4zb18knarKSJkje_Jn5cQ6sC6kQWJANyO-aqaSxhva6e1AnUY8TJfGQwZXfu8rx1YLdXFcycfcZ8hggtt1GonDA0l2KweCOFh1zxo8YWbgrjwS03Ti1PGEbzGHRL2Hm1hzKb8BghemwMdyQaSHjkNcAwectFEonFd2IGBpovjWX4QOFEUoe-2HerriTiRDUWjVU85GhhdXRoRGF0YVjFT848GIB1YSy2AgqgP_bEoHGe74fBQecLAfr8oYF8zI5FAAAAALk_2WHy5kYvsSKCACJH3ngAQQGTSRAdkXHXDCdJGdV9ZcgOnexDYiheSveOW6W2V8XVaqMoxDUpx0mbsWc_bATFcigAK6VQYcFq-1k7rU_3qTbJpQECAyYgASFYIEX7FSu69CsJFYeJENXguyrgWOgSksV_frUgRBpp4GwaIlgg7PTO3b0fQEo1sQhSm9Zy4oErCZw68wfbAUBnu1EduUc", "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoidkNMQVIzQUdoeGZQMFEtTDkyX0JzcHBraEFDYnkwSGp0TlpFQkZKMGdPayIsIm9yaWdpbiI6Imh0dHBzOi8vcG9ydGFsLmZ4b24uY29tIiwiY3Jvc3NPcmlnaW4iOmZhbHNlLCJvdGhlcl9rZXlzX2Nhbl9iZV9hZGRlZF9oZXJlIjoiZG8gbm90IGNvbXBhcmUgY2xpZW50RGF0YUpTT04gYWdhaW5zdCBhIHRlbXBsYXRlLiBTZWUgaHR0cHM6Ly9nb28uZ2wveWFiUGV4In0", "transports": [ "hybrid", "internal" ], "publicKeyAlgorithm": -7, "publicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAERfsVK7r0KwkVh4kQ1eC7KuBY6BKSxX9-tSBEGmngbBrs9M7dvR9ASjWxCFKb1nLigSsJnDrzB9sBQGe7UR25Rw", "authenticatorData": "T848GIB1YSy2AgqgP_bEoHGe74fBQecLAfr8oYF8zI5FAAAAALk_2WHy5kYvsSKCACJH3ngAQQGTSRAdkXHXDCdJGdV9ZcgOnexDYiheSveOW6W2V8XVaqMoxDUpx0mbsWc_bATFcigAK6VQYcFq-1k7rU_3qTbJpQECAyYgASFYIEX7FSu69CsJFYeJENXguyrgWOgSksV_frUgRBpp4GwaIlgg7PTO3b0fQEo1sQhSm9Zy4oErCZw68wfbAUBnu1EduUc" }, "type": "public-key", "clientExtensionResults": { "credProps": { "rk": false } }, "authenticatorAttachment": "platform" },

[MasterKale]

Thanks for the response @transon12. I'm reviewing some of these issues I've neglected and will come back to this sometime this week.

[MasterKale]

Note to self: debugger link

[MasterKale]

@transon12 I've been taking a look at this issue, and there's something odd about the response your S9+ is generating. The signature of the intermediate certificate in the attestation statement fails to verify because it doesn't appear to be the proper length. The signature decodes to an r and s both of length 48 bytes, which typically indicates use of SHA384 in generating this signature. However the signature algorithm specified in that cert is SHA256, so signature verification can't be completed.

Given the release date of the S9+ as ~2018, and the fact that it's running Android 10, I'm not sure I'm going to dig into this much more. This project has working Android Key attestation verification in this library that can verify responses from other devices. But if the device produces an attestation that's not correctly signed there's not really anything I can do in this library to fix that.

Closing this out for now.

[transon12]

Thank you very much for your reply.

[MasterKale]

I'm reopening this issue because I couldn't let this go and dug back in. I think this might actually highlight a subtle issue with X.509 validation. I'm going to keep at this for a bit longer...

[MasterKale]

@transon12 Apologies for the delay. Your issue did indeed surface an opportunity to improve attestation verification. I've completed the work in #721, but it's not yet been released for one more bit of work I want to complete first before releasing a new version of @simplewebauthn/server that should finally fix your problem.

Thank you for your patience 🙇

[MasterKale]

@transon12 This issue now should be fixed in @simplewebauthn/server@13.2.0. Thank you again for your patience!