[openssl-users] Problem with x509_verify_certificate
Ken
OpenSSL at k-h.us
Sun Nov 18 05:45:05 UTC 2018
I think that the output from s_client (see attached) says that it
passed, for both versions.
Also, the output from s_client shows it looking for the correct CA file
on both versions (and shows that the file exists), but it only opens the
CA file under openssl version "1.0.2j-fips 26 Sep 2016".
------ Original Message ------
From: Felipe Gasper <felipe at felipegasper.com>
Sent: Sat, 17 Nov 2018 22:23:58 -0500
To: Openssl-users <openssl-users at openssl.org>
Subject: Re: [openssl-users] Problem with x509_verify_certificate
> Maybe the set of stores root certificates changed with the update?
>
> Try openssl s_client to debug it?
>
> On Nov 17, 2018, at 8:57 PM, Ken <OpenSSL at k-h.us
> <mailto:OpenSSL at k-h.us>> wrote:
>
>> I use an application, FreeRDP (https://github.com/FreeRDP/FreeRDP),
>> which uses x509_verify_certificate to check the validity of a
>> certificate on a RDP server.
>>
>> Under openSUSE Leap 42.3 (which uses openssl version "1.0.2j-fips 26
>> Sep 2016") everything works great.
>>
>> But, when I upgrade to openSUSE Leap 15.0 (which uses openssl version
>> "1.1.0i-fips 14 Aug 2018") I get an error when connecting to servers
>> that use publicly-signed certificates:
>>
>> Certificate details:
>> Subject: OU = Domain Control Validated, CN = owa.xxxxx.com
>> <http://owa.xxxxx.com>
>> Issuer: C = US, ST = Arizona, L = Scottsdale, O = "Starfield
>> Technologies, Inc.", OU = http://certs.starfieldtech.com/repository/,
>> CN = Starfield Secure Certificate Authority - G2
>> Thumbprint:
>> xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx
>> The above X.509 certificate could not be verified, possibly because
>> you do not have
>> the CA certificate in your certificate store, or the certificate has
>> expired.
>> Please look at the OpenSSL documentation on how to add a private CA
>> to the store.
>> Do you trust the above certificate? (Y/T/N)
>>
>>
>> On both versions, strace shows is it checking for
>> /var/lib/ca-certificates/openssl/4bfab552.0 (which exists, and is the
>> correct CA) - but with openssl version "1.1.0i-fips 14 Aug 2018", it
>> never opens that file. (With openssl version "1.0.2j-fips 26 Sep
>> 2016", it does open/read that file, which it seems like it work need
>> to, in order to find out if it matches the certificate.)
>>
>>
>> Any idea what changed? (Or, better question, what needs to be changed
>> to make this application work again?)
>>
>>
>> Thanks,
>> Ken
>> --
>> openssl-users mailing list
>> To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mta.openssl.org/pipermail/openssl-users/attachments/20181117/cc20c613/attachment.html>
-------------- next part --------------
openssl s_client -connect owa.xxxxx.com:3389 < /dev/null
CONNECTED(00000003)
depth=2 C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", CN = Starfield Root Certificate Authority - G2
verify return:1
depth=1 C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", OU = http://certs.starfieldtech.com/repository/, CN = Starfield Secure Certificate Authority - G2
verify return:1
depth=0 OU = Domain Control Validated, CN = owa.xxxxx.com
verify return:1
---
Certificate chain
0 s:/OU=Domain Control Validated/CN=owa.xxxxx.com
i:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./OU=http://certs.starfieldtech.com/repository//CN=Starfield Secure Certificate Authority - G2
1 s:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./OU=http://certs.starfieldtech.com/repository//CN=Starfield Secure Certificate Authority - G2
i:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./CN=Starfield Root Certificate Authority - G2
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIGNDCCBRygAwIBAgIIXFXbiPD1+PYwDQYJKoZIhvcNAQELBQAwgcYxCzAJBgNV
BAYTAlVTMRAwDgYDVQQIEwdBcml6b25hMRMwEQYDVQQHEwpTY290dHNkYWxlMSUw
IwYDVQQKExxTdGFyZmllbGQgVGVjaG5vbG9naWVzLCBJbmMuMTMwMQYDVQQLEypo
.
.
.
vpY77wmUtuPlIBBA0vmoLkqm3kLq31Ax9O83BgLCnHUHBfq3UuJSOIjZb9GDzc1L
1r1jePMxklnJFxFMS+D5gJmSNMoOnaop1EtH+8WAsnR16D15mNdtTHEzH106oJaW
KTNa8smgpv+uweIrV68wsctfTK4jMdZXGdIKFy+8sA7T5aRmme0EbFl8Skzc408K
QT7Tk+QwmXU=
-----END CERTIFICATE-----
subject=/OU=Domain Control Validated/CN=owa.xxxxx.com
issuer=/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./OU=http://certs.starfieldtech.com/repository//CN=Starfield Secure Certificate Authority - G2
---
No client certificate CA names sent
Peer signing digest: SHA1
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 3419 bytes and written 475 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-SHA384
Session-ID: 941A0000A0B1EEA13483B0FEB706B589A9F209BE3358C3A995C4ED1ED59265EE
Session-ID-ctx:
Master-Key: A08B359932ACFD5B74136EBB8493F324A70C4CE59031174867ECA8FF03D1A34A641E8217823F5CDDCDC5075E6DA37BA7
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1542518377
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
DONE
-------------- next part --------------
openssl s_client -connect owa.xxxxx.com:3389 < /dev/null
CONNECTED(00000003)
depth=2 C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", CN = Starfield Root Certificate Authority - G2
verify return:1
depth=1 C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", OU = http://certs.starfieldtech.com/repository/, CN = Starfield Secure Certificate Authority - G2
verify return:1
depth=0 OU = Domain Control Validated, CN = owa.xxxxx.com
verify return:1
---
Certificate chain
0 s:/OU=Domain Control Validated/CN=owa.xxxxx.com
i:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./OU=http://certs.starfieldtech.com/repository//CN=Starfield Secure Certificate Authority - G2
1 s:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./OU=http://certs.starfieldtech.com/repository//CN=Starfield Secure Certificate Authority - G2
i:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./CN=Starfield Root Certificate Authority - G2
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIGNDCCBRygAwIBAgIIXFXbiPD1+PYwDQYJKoZIhvcNAQELBQAwgcYxCzAJBgNV
BAYTAlVTMRAwDgYDVQQIEwdBcml6b25hMRMwEQYDVQQHEwpTY290dHNkYWxlMSUw
IwYDVQQKExxTdGFyZmllbGQgVGVjaG5vbG9naWVzLCBJbmMuMTMwMQYDVQQLEypo
.
.
.
vpY77wmUtuPlIBBA0vmoLkqm3kLq31Ax9O83BgLCnHUHBfq3UuJSOIjZb9GDzc1L
1r1jePMxklnJFxFMS+D5gJmSNMoOnaop1EtH+8WAsnR16D15mNdtTHEzH106oJaW
KTNa8smgpv+uweIrV68wsctfTK4jMdZXGdIKFy+8sA7T5aRmme0EbFl8Skzc408K
QT7Tk+QwmXU=
-----END CERTIFICATE-----
subject=/OU=Domain Control Validated/CN=owa.xxxxx.com
issuer=/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./OU=http://certs.starfieldtech.com/repository//CN=Starfield Secure Certificate Authority - G2
---
No client certificate CA names sent
Peer signing digest: SHA1
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 3423 bytes and written 358 bytes
Verification: OK
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-SHA384
Session-ID: F43500001034795A9A20EA524CE9866A31A3869DB075988A7B545593FE557EEB
Session-ID-ctx:
Master-Key: 1E07E2347032579D218950FB4DE3A15B7A13831405D44157B948D1237C22F6B8B3AE9204352E980765D5476EAF8220E3
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1542518370
Timeout : 7200 (sec)
Verify return code: 0 (ok)
Extended master secret: yes
---
DONE
More information about the openssl-users
mailing list