Hi,
thanks for looking at this …
am Sat, 20 Jul 2019 11:01:49 +0200
schrieb Dirk Gottschalk <dirk.gottschalk1...@googlemail.com>:
> This is the issue here. These two certs of DTAG (Telekom) are exired
> and that's the reason why gpgsm is complaining correctly.
Please check again my original post, though. The issue I see is that
these certs are not even supposed to be in the chain! To repeat the
summary, which may be lost in the noise before it:
The chain in the imported new key & cert file how it should be:
4. Thomas Orgis (me) signed by DFN-Verein Global Issuing CA
3. DFN-Verein Global Issuing CA signed by DFN-Verein Certification Authority 2
2. DFN-Verein Certification Authority 2 signed by T-TeleSec GlobalRoot Class 2
1. T-TeleSec GlobalRoot Class 2 signed by T-TeleSec GlobalRoot Class 2 (root)
Compared to what gpgsm sees/shows:
4. Thomas Orgis (me) signed by DFN-Verein Global Issuing CA
3. DFN-Verein Global Issuing CA signed by DFN-Verein Certification Authority 2
2. DFN-Verein Certification Authority 2 signed by T-TeleSec GlobalRoot Class 2
1. T-TeleSec GlobalRoot Class 2 signed by Deutsche Telekom Root CA 2
0. Deutsche Telekom Root CA 2 signed by Deutsche Telekom Root CA 2 (expired
root)
The bogus signatures by the old Telekom certificates appear only after
importing in gpgsm, and colleagues using the same kind of certificates
use them without problem in software not relying on gpgsm. So I assume
the presence of the old certificates stirs things up. When I create a
fresh user and import the new key with its certs into gpgsm, the chain
looks like it should.
/home/tester/.gnupg/pubring.kbx
-------------------------------
ID: 0x310C60AF
Issuer: /CN=DFN-Verein Global Issuing CA/OU=DFN-PKI/O=Verein zur
Foerderung eines Deutschen Forschungsnetzes e. V./C=DE
Subject: /CN=Thomas
Orgis/OU=HPC/OU=Basis-Infrastruktur/OU=RRZ/O=Universitaet
Hamburg/L=Hamburg/ST=Hamburg/C=DE
validity: 2019-07-05 08:22:41 through 2022-07-04 08:22:41
Certified by
ID: 0xD9463C45
Issuer: /CN=DFN-Verein Certification Authority 2/OU=DFN-PKI/O=Verein zur
Foerderung eines Deutschen Forschungsnetzes e. V./C=DE
Subject: /CN=DFN-Verein Global Issuing CA/OU=DFN-PKI/O=Verein zur
Foerderung eines Deutschen Forschungsnetzes e. V./C=DE
validity: 2016-05-24 11:38:40 through 2031-02-22 23:59:59
chain length: 1
Certified by
ID: 0xD3A89A93
Issuer: /CN=T-TeleSec GlobalRoot Class 2/OU=T-Systems Trust
Center/O=T-Systems Enterprise Services GmbH/C=DE
Subject: /CN=DFN-Verein Certification Authority 2/OU=DFN-PKI/O=Verein zur
Foerderung eines Deutschen Forschungsnetzes e. V./C=DE
validity: 2016-02-22 13:38:22 through 2031-02-22 23:59:59
chain length: 2
Certified by
ID: 0x17D894E9
Issuer: /CN=T-TeleSec GlobalRoot Class 2/OU=T-Systems Trust
Center/O=T-Systems Enterprise Services GmbH/C=DE
Subject: /CN=T-TeleSec GlobalRoot Class 2/OU=T-Systems Trust
Center/O=T-Systems Enterprise Services GmbH/C=DE
validity: 2008-10-01 10:40:14 through 2033-10-01 23:59:59
chain length: unlimited
So this looks like a corruption in my keyring that includes the history
of using gpgsm for about 5 years:-/ I now could play games with
exporting keys and starting with a fresh database … but I'd like to
have understood first what happened here.
Regards,
Thomas
--
Dr. Thomas Orgis
HPC @ Universität Hamburg
_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users
