On Sun 2015-01-18 06:58:27 -0500, Uri Blumenthal via RT wrote:
> OpenSSL 1.0.1k and 1.0.1l. Problem: good certificates fail verification (test
> certificate and its CA cert that illustrate the problem are attached, as well
> as the patch/workaround).
>
> Here’s how the problem manifests itself:
> $ openssl version -f
> compiler: -I. -I.. -I../include -fPIC -fno-common -DOPENSSL_PIC -DZLIB
> -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -arch x86_64 -O3
> -DL_ENDIAN -Wall -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT
> -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM
> -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM
> -DGHASH_ASM
> $ openssl verify -CAfile RabbitMQ_Test_CA.pem RabbitMQ_Test.pem
> RabbitMQ_Test.pem: CN = RabbitMQ_Test, C = US
> error 7 at 0 depth lookup:certificate signature failure
> $ /usr/bin/openssl version -f
> compiler: -arch x86_64 -fmessage-length=0 -pipe -Wno-trigraphs
> -fpascal-strings -fasm-blocks -O3 -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H
> -DL_ENDIAN -DMD32_REG_T=int -DOPENSSL_NO_IDEA -DOPENSSL_PIC -DOPENSSL_THREADS
> -DZLIB -mmacosx-version-min=10.6
> $ /usr/bin/openssl verify -CAfile RabbitMQ_Test_CA.pem RabbitMQ_Test.pem
> RabbitMQ_Test.pem: OK
> $
the "version" commands above don't indicate what version was tried in
each case. I tested the verify command on 1.0.1j on debian unstable,
and found that it returns:
RabbitMQ_Test.pem: OK
this suggests that Uri is reporting a regression in 1.0.1k and 1.0.1l.
I haven't tested those version yet.
I also tested the certificate chain with gnutls and NSS, and both seemed
to think the chain was OK.
GnuTLS 3.3.8:
1 dkg@alice:~/tmp$ cat RabbitMQ_Test.pem RabbitMQ_Test_CA.pem | certtool
--verify-chain
Loaded 2 certificates, 1 CAs and 0 CRLs
Subject: CN=RabbitMQ_Test,C=US
Issuer: CN=RabbitMQ_Test_CA,C=US,[email protected]
Checked against: CN=RabbitMQ_Test_CA,C=US,[email protected]
Output: Verified. The certificate is trusted.
Chain verification output: Verified. The certificate is trusted.
0 dkg@alice:~/tmp$
NSS 3.17.2 (from an empty directory, where we're going to create an NSS
certificate db):
0 dkg@alice:/tmp/cdtemp.hknE0D$ certutil -d $(pwd) -A -n rabbitmq -t cT,, <
~/tmp/RabbitMQ_Test_CA.pem
0 dkg@alice:/tmp/cdtemp.hknE0D$ vfychain -a -d $(pwd) -u 0
~/tmp/RabbitMQ_Test.pem
Chain is good!
0 dkg@alice:/tmp/cdtemp.hknE0D$
--dkg
_______________________________________________
openssl-dev mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
