Re: issue with p12 creation and network solutions EV SSL

Mounir IDRASSI Tue, 26 Apr 2011 08:39:32 -0700

Hi,

Your SSL certificate has an Authority Key Identifier extension which hasa value of "8a 35 e4 35 3a bc 11 a1 9e fb f5 4f 34 66 d5 4b ac 4c 6268". This indicates that it has NOT been issued by the "NetworkSolutions EV Server CA" certificate that is present in the chain fileyou posted: this one has a Subject Key Identifier extension equal to "b64e 85 9d 84 1f 1b 1d d4 52 89 4e 07 96 2d f9 de f1 8f cc".

Actually, your SSL certificate has been signed by an updated "NetworkSolutions EV Server CA" certificate which was reissued on 11/26/2010 andthat has a Subject Key Identifier extension equal to the Authority KeyIdentifier extension of your SSL certificate. And this update CAcertificate is in turn reissued by an updated "Network SolutionsCertificate Authority" certificate that was issued on 10/10/2010.

So, the chain file you are using is wrong and you should use the updatedone. I have reconstructed the correct one for you. Here it is :


<======================================================>
-----BEGIN CERTIFICATE-----
MIIE8DCCA9igAwIBAgIQeqyiHVOdFFQRPARe2DX46jANBgkqhkiG9w0BAQUFADBi
MQswCQYDVQQGEwJVUzEhMB8GA1UEChMYTmV0d29yayBTb2x1dGlvbnMgTC5MLkMu
MTAwLgYDVQQDEydOZXR3b3JrIFNvbHV0aW9ucyBDZXJ0aWZpY2F0ZSBBdXRob3Jp
dHkwHhcNMTAxMTI2MDAwMDAwWhcNMjAwNTMwMTA0ODM4WjBZMQswCQYDVQQGEwJV
UzEhMB8GA1UEChMYTmV0d29yayBTb2x1dGlvbnMgTC5MLkMuMScwJQYDVQQDEx5O
ZXR3b3JrIFNvbHV0aW9ucyBFViBTZXJ2ZXIgQ0EwggEiMA0GCSqGSIb3DQEBAQUA
A4IBDwAwggEKAoIBAQDQNVzi55UamI/YT9bV3H5cgr+fzEv6PEqBvNrFp+mtmiaP
3BksYxI+Vt915kis40eQf18I8aOA0dDNJc1Z860uw+sGCf45JDmioezExJrXoAhV
/sjFZC785waIlcE+MVpV8B2YBJS0f17ckKmhhceqErmH0aNxEQJsfpvJOevstVgn
i6OYEaCrg/skMACuAlf+gOLKj0hgYznbr5Z0g7s7bO+zM8am3DHp+byqtx7I9H9Y
aXLuWo82Cv4yERw0PXmIadfaMHM2aOH8EChB7mx/iAg+k3djiqrIqHvLNHAEoWw7
bUgn1D0Xugyj4Ypaqx/hcibDjiYyKNlySQ7u5XVDAgMBAAGjggGpMIIBpTAfBgNV
HSMEGDAWgBQhMMn7ANdOmNqHqirQpy6xQDGnTDAdBgNVHQ4EFgQUijXkNTq8EaGe
+/VPNGbVS6xMYmgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAw
ZgYDVR0gBF8wXTBbBgRVHSAAMFMwUQYIKwYBBQUHAgEWRWh0dHA6Ly93d3cubmV0
d29ya3NvbHV0aW9ucy5jb20vbGVnYWwvU1NMLWxlZ2FsLXJlcG9zaXRvcnktZXYt
Y3BzLmpzcDBSBgNVHR8ESzBJMEegRaBDhkFodHRwOi8vY3JsLm5ldHNvbHNzbC5j
b20vTmV0d29ya1NvbHV0aW9uc0NlcnRpZmljYXRlQXV0aG9yaXR5LmNybDCBggYI
KwYBBQUHAQEEdjB0MEsGCCsGAQUFBzAChj9odHRwOi8vY3J0LnVzZXJ0cnVzdC5j
b20vTmV0d29ya1NvbHV0aW9uc0FkZFRydXN0RVZTZXJ2ZXJDQS5jcnQwJQYIKwYB
BQUHMAGGGWh0dHA6Ly9vY3NwLm5ldHNvbHNzbC5jb20wDQYJKoZIhvcNAQEFBQAD
ggEBADtBp7D2JBjlyHcOqAW86EhXzoEj/xeYaAGJxWmewqtFq3NMJclvdwVyEOue
XnIM99N/vGMcsOVMRAGZH+He/HDjd+XY6aktld0Fz27Fx9ncL9FAfo/pR4uH2YEz
pStMuS6k4ajMHGvPBDZaqqSgdDAbUSDHYblQGOS/K8P4pvqMiRYhmadaQ5kDbXTg
i+qweI4gAdIpsozxeyoIsmJqMDZdXKc7Su73BzJHLfaIYgypJOBw36KmQgx7fSgF
1wtt5YT78MmIs6nZAcOcmNzLg0fs+dGeoFxdpzFSuF2wkQNvHmrv4zYC4xpdMUqQ
FhvXMwUw+wCqKOtfDecUViddfLQ=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIFLjCCBBagAwIBAgIQXclynOqKeVoX7tu/zCghSzANBgkqhkiG9w0BAQUFADBv
MQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFk
ZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBF
eHRlcm5hbCBDQSBSb290MB4XDTEwMTAxMDEwMTAxMFoXDTIwMDUzMDEwNDgzOFow
YjELMAkGA1UEBhMCVVMxITAfBgNVBAoTGE5ldHdvcmsgU29sdXRpb25zIEwuTC5D
LjEwMC4GA1UEAxMnTmV0d29yayBTb2x1dGlvbnMgQ2VydGlmaWNhdGUgQXV0aG9y
aXR5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5Lx+kjBtxtiOKwu8
Rs7gJ5be3vn6EtM8M3OzBC+8cYzln7YiYD5fXc4J/4IMG5pRUBomid3VYV0Z3BIP
LQqiQ10X0DSSIOpzzzgsBiYJenL3+lAy+MKT02miI85Bsczk1R820Yo6+Ixj4hRZ
ae0N039r6LgD5U9q5ZhjaUgFvi7/M7bpl1lp+GcZrpNhlkQV03KwP7xqfexIf43D
q6pxK1NpQVM0tbC5xQYKxLBF9UFdbolFez07Jox0wuXS0X2yEdT7WDIimoDJ3P0M
6X9eA5fOOwAUhydwOKmObrMndphR4AXjIasa1YUiPCm1mhbFgKj0u2swjy9GAqKx
DCLg0wIDAQABo4IB0TCCAc0wHwYDVR0jBBgwFoAUrb2YejS0Jvf6xCZU7wO94CTL
VBowHQYDVR0OBBYEFCEwyfsA106Y2oeqKtCnLrFAMadMMA4GA1UdDwEB/wQEAwIB
BjAPBgNVHRMBAf8EBTADAQH/MG4GA1UdIARnMGUwYwYMKwYBBAGGDgECAQgBMFMw
UQYIKwYBBQUHAgEWRWh0dHA6Ly93d3cubmV0d29ya3NvbHV0aW9ucy5jb20vbGVn
YWwvU1NMLWxlZ2FsLXJlcG9zaXRvcnktZXYtY3BzLmpzcDBEBgNVHR8EPTA7MDmg
N6A1hjNodHRwOi8vY3JsLnVzZXJ0cnVzdC5jb20vQWRkVHJ1c3RFeHRlcm5hbENB
Um9vdC5jcmwwgbMGCCsGAQUFBwEBBIGmMIGjMD8GCCsGAQUFBzAChjNodHRwOi8v
Y3J0LnVzZXJ0cnVzdC5jb20vQWRkVHJ1c3RFeHRlcm5hbENBUm9vdC5wN2MwOQYI
KwYBBQUHMAKGLWh0dHA6Ly9jcnQudXNlcnRydXN0LmNvbS9BZGRUcnVzdFVUTlNH
Q0NBLmNydDAlBggrBgEFBQcwAYYZaHR0cDovL29jc3AudXNlcnRydXN0LmNvbTAN
BgkqhkiG9w0BAQUFAAOCAQEAQbJTbI4r8iImYQdMT+qI4AhyNO14VhPNMHy2F058
a4W/3JAbXWAl/rNC49vE/7BLKBxRZn/3CB9cxRLm4cXRjnoW6I1iuYQ/vGdR+AoT
H6egK4vifO35cCPFLIq5IQx+SdufcuWdFSLySL814kswfwLYoCx96qE+d/a0wVoV
o+fSspKwv1NQSzhdErPCINa9GY/Q9LrE5Dg1OMPbe03AnkTdf8rNd4/lr6S12SYm
FeeW+Y2mWbh/YIOKZMaN/ZeWcdpgcIwfTfwx2pUQ7Yahy1ihDqjusinPpIuUl0PC
+v/apwI8P+RW99qe6MpAjiuvQ00uqbfh0w4VvAkvbbBFlA==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIENjCCAx6gAwIBAgIBATANBgkqhkiG9w0BAQUFADBvMQswCQYDVQQGEwJTRTEU
MBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFkZFRydXN0IEV4dGVybmFs
IFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBFeHRlcm5hbCBDQSBSb290
MB4XDTAwMDUzMDEwNDgzOFoXDTIwMDUzMDEwNDgzOFowbzELMAkGA1UEBhMCU0Ux
FDASBgNVBAoTC0FkZFRydXN0IEFCMSYwJAYDVQQLEx1BZGRUcnVzdCBFeHRlcm5h
bCBUVFAgTmV0d29yazEiMCAGA1UEAxMZQWRkVHJ1c3QgRXh0ZXJuYWwgQ0EgUm9v
dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALf3GjPm8gAELTngTlvt
H7xsD821+iO2zt6bETOXpClMfZOfvUq8k+0DGuOPz+VtUFrWlymUWoCwSXrbLpX9
uMq/NzgtHj6RQa1wVsfwTz/oMp50ysiQVOnGXw94nZpAPA6sYapeFI+eh6FqUNzX
mk6vBbOmcZSccbNQYArHE504B4YCqOmoaSYYkKtMsE8jqzpPhNjfzp/haW+710LX
a0Tkx63ubUFfclpxCDezeWWkWaCUN/cALw3CknLa0Dhy2xSoRcRdKn23tNbE7qzN
E0S3ySvdQwAl+mG5aWpYIxG3pzOPVnVZ9c0p10a3CitlttNCbxWyuHv77+ldU9U0
WicCAwEAAaOB3DCB2TAdBgNVHQ4EFgQUrb2YejS0Jvf6xCZU7wO94CTLVBowCwYD
VR0PBAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wgZkGA1UdIwSBkTCBjoAUrb2YejS0
Jvf6xCZU7wO94CTLVBqhc6RxMG8xCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtBZGRU
cnVzdCBBQjEmMCQGA1UECxMdQWRkVHJ1c3QgRXh0ZXJuYWwgVFRQIE5ldHdvcmsx
IjAgBgNVBAMTGUFkZFRydXN0IEV4dGVybmFsIENBIFJvb3SCAQEwDQYJKoZIhvcN
AQEFBQADggEBALCb4IUlwtYj4g+WBpKdQZic2YR5gdkeWxQHIzZlj7DYd7usQWxH
YINRsPkyPef89iYTx4AWpb9a/IfPeHmJIZriTAcKhjW88t5RxNKWt9x+Tu5w/Rw5
6wwCURQtjr0W4MHfRnXnJK3s9EK0hZNwEGe6nQY1ShjTK3rMUUKhemPR5ruhxSvC
Nr4TDea9Y355e6cJDUCrat2PisP29owaQgVR1EX1n6diIWgVIEM8med8vSTYqZEX
c4g/VhsxOBi0cQ+azcgOno4uG+GMmIPLHzHxREzGBHNJdmAPx/i9F4BrLunMTA5a
mnkPIAou1Z5jJh5VkpTYghdae9C8x49OhgQ=
-----END CERTIFICATE-----
<======================================================>

I hope this will help.
Cheers,
--
Mounir IDRASSI
IDRIX
http://www.idrix.fr


On 4/26/2011 2:29 PM, James Chase wrote:

Someone suggested it would be helpful to post the chain file and thesite's public certificate to the list. If it is helpful, here is thesite cert (and below that their supplied chain file)

On Tue, Apr 26, 2011 at 8:19 AM, James Chase <chase1...@gmail.com<mailto:chase1...@gmail.com>> wrote:


    Well my results are quite different, and I guess point to my p12
    not being correctly created. Strangely, the p12 I am running this
    test on works in production and doesn't produce a warning (I
    re-created last years certificate as a new p12 using the same
    process I am trying with this years).

    I also tried running this on my test apache site, where I am just
    using the plain old certificate, key and network solutions
    supplied chain file -- and the openssl s_client command returns
    better output but I still get a warning!

    [me@myserver ~]$ openssl s_client -connect www.example.com:443
    <http://www.example.com:443>
    CONNECTED(00000003)
    depth=0 /serialNumber=03-11-

    
1975/1.3.6.1.4.1.311.60.2.1.3=US/1.3.6.1.4.1.311.60.2.1.2=Massachusetts/1.3.6.1.4.1.311.60.2.1.1=A
    City/2.5.4.15 <http://2.5.4.15>=V1.0, Clause

    5.(b)/C=US/postalCode=05767/ST=MA/L=A City/streetAddress=One Park
    St/O=A Company International Ltd
    verify error:num=20:unable to get local issuer certificate
    verify return:1
    depth=0 /serialNumber=03-11-

    
1975/1.3.6.1.4.1.311.60.2.1.3=US/1.3.6.1.4.1.311.60.2.1.2=Massachusetts/1.3.6.1.4.1.311.60.2.1.1=A
    City/2.5.4.15 <http://2.5.4.15>=V1.0, Clause

    5.(b)/C=US/postalCode=05767/ST=MA/L=A City/streetAddress=One Park
    St/O=A Company International Ltd
    verify error:num=27:certificate not trusted
    verify return:1
    depth=0 /serialNumber=03-11-

    
1975/1.3.6.1.4.1.311.60.2.1.3=US/1.3.6.1.4.1.311.60.2.1.2=Massachusetts/1.3.6.1.4.1.311.60.2.1.1=A
    City/2.5.4.15 <http://2.5.4.15>=V1.0, Clause

    5.(b)/C=US/postalCode=05767/ST=MA/L=A City/streetAddress=One Park
    St/O=A Company International Ltd
    verify error:num=21:unable to verify the first certificate
    verify return:1
    ---
    Certificate chain
     0 s:/serialNumber=03-11-

    
1975/1.3.6.1.4.1.311.60.2.1.3=US/1.3.6.1.4.1.311.60.2.1.2=Massachusetts/1.3.6.1.4.1.311.60.2.1.1=A
    City/2.5.4.15 <http://2.5.4.15>=V1.0, Clause

    5.(b)/C=US/postalCode=05767/ST=MA/L=A City/streetAddress=One Park
    St/O=A Company International Ltd/OU=Book

    Sales/OU=Secure Link EV SSL/CN=www.example.com
    <http://www.example.com>
       i:/C=US/O=Network Solutions L.L.C./CN=Network Solutions EV SSL CA
    ---

    On Mon, Apr 25, 2011 at 6:16 PM, Rob Stradling
    <rob.stradl...@comodo.com <mailto:rob.stradl...@comodo.com>> wrote:

        On Monday 25 Apr 2011 20:07:03 James Chase wrote:
        > I simplified the issue a bit in order to try and understand
        what is going
        > on here and found that the SSL certificate that Network
        Solutions is
        > providing, along with the intermediate chain file cannot be
        verified by
        > newer installs of Firefox.

        Hi James.  That seems unlikely.  Try browsing to NetSol's own
        EV site
        (https://www.networksolutions.com) in FF4.  I see the EV green
        bar and no
        browser warnings.

        Could you post the top part of the output from "openssl
        s_client -connect
        yourdomain:yourport" ?

        Then we can compare it with...

        $ openssl s_client -connect www.networksolutions.com:443
        <http://www.networksolutions.com:443>
        CONNECTED(00000003)
        depth=3 C = SE, O = AddTrust AB, OU = AddTrust External TTP
        Network, CN =
        AddTrust External CA Root
        verify error:num=19:self signed certificate in certificate chain
        verify return:0
        ---
        Certificate chain
         0
        
s:/serialNumber=3713002/1.3.6.1.4.1.311.60.2.1.3=US/1.3.6.1.4.1.311.60.2.1.2=Delaware/businessCategory=Private
        Organization/C=US/ST=VA/L=Herndon/O=Network Solutions,
        LLC/OU=Technology
        Services/OU=Secure Link EV SSL/CN=www.networksolutions.com
        <http://www.networksolutions.com>
          i:/C=US/O=Network Solutions L.L.C./CN=Network Solutions EV
        Server CA
         1 s:/C=US/O=Network Solutions L.L.C./CN=Network Solutions EV
        Server CA
          i:/C=US/O=Network Solutions L.L.C./CN=Network Solutions
        Certificate
        Authority
         2 s:/C=US/O=Network Solutions L.L.C./CN=Network Solutions
        Certificate
        Authority
          i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP
        Network/CN=AddTrust External
        CA Root
         3 s:/C=SE/O=AddTrust AB/OU=AddTrust External TTP
        Network/CN=AddTrust External
        CA Root
          i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP
        Network/CN=AddTrust External
        CA Root
        ---

        > It doesn't have anything to do with the p12
        > file I am creating (I loaded up the network solutions files
        in apache and
        > tested).
        >
        > Who would be at fault here? Am I still doing something
        wrong, or is this
        > Mozilla's fault for not including a needed root ca file? It
        seems the
        > missing link is the "AddTrustExternalCARoot" certificate.
        >
        > I tried adding the AddTrustExternalCARoot cert to the top of
        my certificate
        > chain, but this causes apache to break, and then not start
        complaining of
        > "[error] Failed to configure CA certificate chain!". I used
        a chain file
        > that I have used in previous years, and that did allow
        apache to start but
        > I still cannot verify with Firefox. Then I tried using last
        years (and
        > soon expiring) certificate for my site and that works FINE.
        So ... Network
        > Solutions screwed something up when issuing my certificate
        (this is the
        > second one I have had re-issued) or am I doing something
        wrong. I have no
        > idea what that could be at this point -- I have never had so
        much trouble
        > with an SSL certificate and am not an expert by any means.
        >
        > Anyone have any thoughts? I called NS earlier in this
        process and they said
        > "not our problem" but perhaps I will try again.
        >
        > On Mon, Apr 25, 2011 at 11:01 AM, James Chase
        <chase1...@gmail.com <mailto:chase1...@gmail.com>> wrote:
        > > I did run the verification, and didn't have an issue
        there. Still am not
        > > able to figure out how to correctly create this as the
        only way the p12
        > > compiles is by dropping the "-chain" command but that
        creates ssl
        > > verifications warnings in Firefox web browsers.
        > >
        > > openssl req -verify -in www.example.com.csr -key
        www.example.com.key
        > > verify OK
        > > -----BEGIN CERTIFICATE REQUEST-----
        > > CERTIFICATE DATA HERE
        > > -----END CERTIFICATE REQUEST-----
        > >
        > > On Sat, Apr 23, 2011 at 4:41 PM, James Chase
        <chase1...@gmail.com <mailto:chase1...@gmail.com>> wrote:
        > >> I am using the same system -- I have tried with last
        years chain file as
        > >> well. The only thing that would be different to my
        knowledge are
        > >> possibly the version of openssl and the renewed crt file
        if it possibly
        > >> requires new CA's (I did use their most current
        certificates before I
        > >> tried using my old cafile).
        > >>
        > >> openssl verify never returns, I'm not sure what the
        syntax I am shooting
        > >> for there is.
        > >>
        > >> When i try without using the "-chain" command then it
        compiles the p12
        > >> and it does seem to load in Chrome and IE ,but in FF3 I get:
        > >>
        > >> secure.example.com <http://secure.example.com> uses an
        invalid security certificate.
        > >>
        > >> The certificate is not trusted because the issuer
        certificate is
        > >> unknown.
        > >>
        > >> (Error code: sec_error_unknown_issuer)
        > >>
        > >> And in FF4 I get:
        > >>
        > >> store.innertraditions.com
        <http://store.innertraditions.com> uses an invalid security
        certificate.
        > >>
        > >> The certificate is not trusted because no issuer chain
        was provided.
        > >>
        > >> (Error code: sec_error_unknown_issuer)
        > >>
        > >>
        > >> I have always used the -chain and -CAfile options
        together when creating
        > >> p12's.
        > >>
        > >> On Sat, Apr 23, 2011 at 12:32 PM, Crypto Sal
        <crypto....@gmail.com <mailto:crypto....@gmail.com>>wrote:
        > >>>  On 04/21/2011 06:51 PM, James Chase wrote:
        > >>> I have done this multiple years in a row with the exact
        same process
        > >>> but now I get the following error when I try to create
        my SSL:
        > >>>
        > >>> openssl pkcs12 -export -chain -CAfile cachain.crt -out
        > >>> my.domain.com.p12 -inkey my.domain.com.key -in
        MY.DOMAIN.COM.crt
        > >>> Error unable to get local issuer certificate getting chain.
        > >>>
        > >>> I concatenated all the intermediate files in the order
        they suggest,
        > >>> and according to the process I have documented that has
        worked the
        > >>> past few years. I also downloaded the pre-built chain
        file where they
        > >>> already concatenated the needed files together but I get
        the same
        > >>> error. I also tried the same chain file I used last year
        -- same
        > >>> results. Googling is not helping me understand this
        error. Anyone know
        > >>> what could be going on here with the EV SSL creation for
        Network
        > >>> Solutions?
        > >>>
        > >>>
        > >>> --
        > >>> "Beware of all enterprises that require new clothes."
        > >>>
        > >>>   --  Henry David Thoreau
        > >>>
        > >>> James,
        > >>>
        > >>> You don't need to include the -chain' option since you
        are providing
        > >>> the chain with the '-CAfile' option. '-chain' is if you
        want OpenSSL
        > >>> to build the chain for you.
        > >>>
        > >>> --Crypto.Sal
        > >>
        > >> --
        > >> "Beware of all enterprises that require new clothes."
        > >>
        > >>   --  Henry David Thoreau
        > >
        > > --
        > > "Beware of all enterprises that require new clothes."
        > >
        > >   --  Henry David Thoreau

        Rob Stradling
        Senior Research & Development Scientist
        COMODO - Creating Trust Online
        ______________________________________________________________________
        OpenSSL Project http://www.openssl.org
        User Support Mailing List openssl-users@openssl.org
        <mailto:openssl-users@openssl.org>
        Automated List Manager majord...@openssl.org
        <mailto:majord...@openssl.org>

--"Beware of all enterprises that require new clothes."

      --  Henry David Thoreau




--
"Beware of all enterprises that require new clothes."
  --  Henry David Thoreau

Re: issue with p12 creation and network solutions EV SSL

Reply via email to