Bug#782549: marked as done (Client certificate validation fails: "certificate invalid")

Debian Bug Tracking System Thu, 16 Apr 2015 11:54:34 -0700

Your message dated Thu, 16 Apr 2015 19:51:06 +0100
with message-id <[email protected]>
and subject line Re: Client certificate validation fails: "certificate invalid" 
-- was user error
has caused the Debian Bug report #782549,
regarding Client certificate validation fails: "certificate invalid"
to be marked as done.


This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)


-- 
782549: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=782549
Debian Bug Tracking System
Contact [email protected] with problems

--- Begin Message ---

Package: exim4
Version: 4.84-8
Severity: normal

I'm not having much lucky trying to get client certificate validation to
work. When I run exim with debug logging turned on, the client sends its
certificate and the server logs:

    13546 SMTP>> 220 TLS go ahead
    13546 TLS: no SNI presented in handshake.
    13546 gnutls_handshake was successful
    13546 TLS certificate verification failed (certificate invalid): 
peerdn="CN=traxus.robots.org.uk"
    13546 TLS verify failure overridden (host in tls_try_verify_hosts)
    13546 cipher: TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256

There's no indication of what about the certificate is invalid though.
The only reference to this error that I could find was an upstream bug
<https://github.com/Exim/exim/issues/19> which refers to a bug with
GnuTLS and certificates using sha512WithRSAEncryption, but my
certificate is only using RSA-SHA256 as the signature algorithm so I
don't think that's it. I'll attach the client certificate in case you
have an idea what is causing the 'certificate invalid' message; I can
also send you a certificate/key that the server should accept if that
would help.

On the server side, the config is pretty straight forward; I've just set
the following:

    MAIN_TLS_ENABLE = yes
    MAIN_TLS_CERTIFICATE = CONFDIR/ssl/smtp-2014-cert+chain.pem
    MAIN_TLS_PRIVATEKEY = CONFDIR/ssl/smtp-2014-key.pem
    MAIN_LOG_SELECTOR = +tls_certificate_verified +tls_cipher +tls_peerdn
    MAIN_TLS_TRY_VERIFY_HOSTS = *
    MAIN_TLS_VERIFY_CERTIFICATES = /etc/exim4/ssl/ca.pem

And on the client side:

    REMOTE_SMTP_SMARTHOST_TLS_CERTIFICATE = 
/etc/exim4/ssl/traxus.robots.org.uk-cert.pem
    REMOTE_SMTP_SMARTHOST_TLS_PRIVATEKEY = 
/etc/exim4/ssl/traxus.robots.org.uk-key.pem

As for the swaks command line:

    swaks --server smtp.robots.org.uk --to [email protected] -tls --tls-verify 
--tls-cert /etc/exim4/ssl/traxus.robots.org.uk-cert.pem --tls-key 
/etc/exim4/ssl/traxus.robots.org.uk-key.pem

-- Package-specific info:
Exim version 4.84 #2 built 17-Feb-2015 17:01:49
Copyright (c) University of Cambridge, 1995 - 2014
(c) The Exim Maintainers and contributors in ACKNOWLEDGMENTS file, 2007 - 2014
Berkeley DB: Berkeley DB 5.3.28: (September  9, 2013)
Support for: crypteq iconv() IPv6 PAM Perl Expand_dlfunc GnuTLS 
move_frozen_messages Content_Scanning DKIM Old_Demime PRDR OCSP
Lookups (built-in): lsearch wildlsearch nwildlsearch iplsearch cdb dbm dbmjz 
dbmnz dnsdb dsearch ldap ldapdn ldapm mysql nis nis0 passwd pgsql sqlite
Authenticators: cram_md5 cyrus_sasl dovecot plaintext spa
Routers: accept dnslookup ipliteral iplookup manualroute queryprogram redirect
Transports: appendfile/maildir/mailstore/mbx autoreply lmtp pipe smtp
Fixed never_users: 0
Size of off_t: 8
Configuration file is /var/lib/exim4/config.autogenerated
# /etc/exim4/update-exim4.conf.conf
#
# Edit this file and /etc/mailname by hand and execute update-exim4.conf
# yourself or use 'dpkg-reconfigure exim4-config'
#
# Please note that this is _not_ a dpkg-conffile and that automatic changes
# to this file might happen. The code handling this will honor your local
# changes, so this is usually fine, but will break local schemes that mess
# around with multiple versions of the file.
#
# update-exim4.conf uses this file to determine variable values to generate
# exim configuration macros for the configuration file.
#
# Most settings found in here do have corresponding questions in the
# Debconf configuration, but not all of them.
#
# This is a Debian specific file

dc_eximconfig_configtype='internet'
dc_other_hostnames='traxus ; traxus.robots.org.uk ; +virtual_domains ; 
+mailman_domains'
dc_local_interfaces=''
dc_readhost=''
dc_relay_domains=''
dc_minimaldns='false'
dc_relay_nets=''
dc_smarthost=''
CFILEMODE='644'
dc_use_split_config='true'
dc_hide_mailname=''
dc_mailname_in_oh='true'
dc_localdelivery='mail_spool'
mailname:traxus.robots.org.uk

-- System Information:
Debian Release: 8.0
  APT prefers testing-updates
  APT policy: (550, 'testing-updates'), (550, 'testing'), (520, 'unstable'), 
(1, 'experimental')
Architecture: i386 (i686)

Kernel: Linux 3.16.0-0.bpo.4-686-pae (SMP w/1 CPU core)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages exim4 depends on:
ii  debconf [debconf-2.0]  1.5.56
ii  exim4-base             4.84-8
ii  exim4-daemon-heavy     4.84-8

exim4 recommends no packages.

exim4 suggests no packages.

-- debconf information:
  exim4/drec:

--- End Message ---

--- Begin Message ---
Upon further debugging this was user error. Sorry for the noise!


-- 
Sam Morris <https://robots.org.uk/>
CAAA AA1A CA69 A83A 892B  1855 D20B 4202 5CDA 27B9
signature.asc
Description: This is a digitally signed message part

--- End Message ---

Bug#782549: marked as done (Client certificate validation fails: "certificate invalid")

Reply via email to