openssl s_client reporta certificado OK, mas outros clientes relatam problemas

Question

openssl s_client reporta certificado OK, mas outros clientes relatam problemas

#1 resposta do (3 votos)

3

Eu configurei um servidor com um certificado SSL, adicionei a cadeia necessária e fiz a configuração do apache. Eu testei usando:

openssl s_client -CAPath /etc/ssl/certs -connect www.example.org:443

e obter vários resultados, incluindo:

Verify return code: 0 (ok)

Tanto o firefox quanto o chrome estão satisfeitos com o site, mas alguns clientes (incluindo o svn) informam que o certificado foi rejeitado. O que há de errado?

Aqui está a saída completa do openssl:

$ openssl s_client -CApath /etc/ssl/certs -connect www.aptivate.org:443
CONNECTED(00000003)
depth=3 L = ValiCert Validation Network, O = "ValiCert, Inc.", OU = ValiCert Class 2 Policy Validation Authority, CN = http://www.valicert.com/, emailAddress = [email protected]
verify return:1
depth=2 C = US, O = "The Go Daddy Group, Inc.", OU = Go Daddy Class 2 Certification Authority
verify return:1
depth=1 C = US, ST = Arizona, L = Scottsdale, O = "GoDaddy.com, Inc.", OU = http://certificates.godaddy.com/repository, CN = Go Daddy Secure Certification Authority, serialNumber = 07969287
verify return:1
depth=0 O = *.aptivate.org, OU = Domain Control Validated, CN = *.aptivate.org
verify return:1
---
Certificate chain
 0 s:/O=*.aptivate.org/OU=Domain Control Validated/CN=*.aptivate.org
   i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287
 1 s:/O=*.aptivate.org/OU=Domain Control Validated/CN=*.aptivate.org
   i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287
 2 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287
   i:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority
 3 s:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority
   i:/L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//[email protected]
 4 s:/L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//[email protected]
   i:/L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//[email protected]
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFVzCCBD+gAwIBAgIHJ+uaBU9wOjANBgkqhkiG9w0BAQUFADCByjELMAkGA1UE
BhMCVVMxEDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxGjAY
BgNVBAoTEUdvRGFkZHkuY29tLCBJbmMuMTMwMQYDVQQLEypodHRwOi8vY2VydGlm
aWNhdGVzLmdvZGFkZHkuY29tL3JlcG9zaXRvcnkxMDAuBgNVBAMTJ0dvIERhZGR5
IFNlY3VyZSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTERMA8GA1UEBRMIMDc5Njky
ODcwHhcNMTEwMTEyMTcwNjE4WhcNMTQwMTEyMTcwNjE4WjBVMRcwFQYDVQQKDA4q
LmFwdGl2YXRlLm9yZzEhMB8GA1UECwwYRG9tYWluIENvbnRyb2wgVmFsaWRhdGVk
MRcwFQYDVQQDDA4qLmFwdGl2YXRlLm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBANogFQnLwi8hKKJ6rm117cJSxeIOmt9dZT+5MsxQO7YesHM/hOuy
/Dk6WI6eaFPgms+w1EgEalbyaagMpnAoCnfQPfXFM221MzKXbD9w0+iXi3nwdCBw
vnsgPsCtaz1uDBrEALN+NympRyb8jGVWCaGY2ypPxpqvO8olkNSvrVhsFy+EdfmA
IPvCinuvBQXaUI6gcoEAM/yFE4u2a0NkXip/vmUgAH8u5Hz/ksx36J+oWpl59ofk
6K+VuudjRU8vpaoYY2HSL01p1w1b6QFHU2RvD/FrQg0spZXflfULULEbjcH69gEL
slg9oqL3coVS8XVN0wwWM10SHUQN4s2rhTsCAwEAAaOCAbQwggGwMA8GA1UdEwEB
/wQFMAMBAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA4GA1UdDwEB
/wQEAwIFoDAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8vY3JsLmdvZGFkZHkuY29t
L2dkczEtMjguY3JsME0GA1UdIARGMEQwQgYLYIZIAYb9bQEHFwEwMzAxBggrBgEF
BQcCARYlaHR0cHM6Ly9jZXJ0cy5nb2RhZGR5LmNvbS9yZXBvc2l0b3J5LzCBgAYI
KwYBBQUHAQEEdDByMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5nb2RhZGR5LmNv
bS8wSgYIKwYBBQUHMAKGPmh0dHA6Ly9jZXJ0aWZpY2F0ZXMuZ29kYWRkeS5jb20v
cmVwb3NpdG9yeS9nZF9pbnRlcm1lZGlhdGUuY3J0MB8GA1UdIwQYMBaAFP2sYTKT
bEXW4u6FX5q653aZaMznMCcGA1UdEQQgMB6CDiouYXB0aXZhdGUub3JnggxhcHRp
dmF0ZS5vcmcwHQYDVR0OBBYEFIfBDt6TU0GGA1uyaEeC3yePHYgoMA0GCSqGSIb3
DQEBBQUAA4IBAQAjJ27yI6vf9QwFIWDiqyTx7jsWYJAGqPG0KsyNgMYBaXdSSY+b
q0dKSRtBwX8sM4sR1ahSNLFlajIy+3dzm/qsk16vKgV+NPgz+Zl7pqm6NaObW+uV
XWw9QHln7jvQXadhV9JXU4/mjF76/0eWs1egLhBn8vgtcqAS4ZckwxLXNmEGm729
IGIppZwe/yy66KJ2tahkCeWBcrNkdcnxsWsD60hfRR4fe8FrQMUxeeIca7c3LguG
0KhtI/fJN+iVORdfG8enJkjZzQW67z/W3gFM1AVIrnmu94DQ9Ro/vD7vp55YkBld
28o9agLg5Dl9cu5Xs7onqcTTJJpCp3AQHQE3
-----END CERTIFICATE-----
subject=/O=*.aptivate.org/OU=Domain Control Validated/CN=*.aptivate.org
issuer=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287
---
No client certificate CA names sent
---
SSL handshake has read 5325 bytes and written 416 bytes
---
New, TLSv1/SSLv3, Cipher is EDH-RSA-DES-CBC3-SHA
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : EDH-RSA-DES-CBC3-SHA
    Session-ID: 5098DC94E1FF98BBD0DBA424A973728346F974FF02700928ECA32E27E10992F5
    Session-ID-ctx: 
    Master-Key: DBE2733FE83E8B3105FD1F63D023AF4DFC5BBA028CC1DD35107FDC9F913A88E2F58C65FBC5839525BF4D529A7DBBA91E
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1352195224
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---

ssl openssl https certificate ssl-certificate

por Hamish Downer 07.11.2012 / 10:52

1 resposta

Tags ssl openssl https certificate ssl-certificate

O Debian Wheezy IPv6 não está configurado com o gancho post-up ifup Desativando o gerenciamento da CPU

score 3 · Answer 1

Acabou que havia um certificado repetido na cadeia. O openssl não se importa com isso, mas o gnutls faz - e o svn usa o gnutls (assim como o LDAP e o mutt, caso eles sejam o seu problema). Aqui está o comando gnutls-cli (pelo menos para sistemas Ubuntu / Debian):

$ gnutls-cli --x509cafile /etc/ssl/certs/ca-certificates.crt -p 443 www.aptivate.org

Embora você possa ver a corrente com gnutls ou openssl. Na saída do openssl acima, você pode ver que existe um certificado repetido.

Certificate chain
 0 s:/O=*.aptivate.org/OU=Domain Control Validated/CN=*.aptivate.org
   i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287
 1 s:/O=*.aptivate.org/OU=Domain Control Validated/CN=*.aptivate.org
   i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287
 2 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287
   i:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority
 3 s:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority
   i:/L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//[email protected]
 4 s:/L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//[email protected]
   i:/L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//[email protected]

Para que gnutls valide isso, o i: (emissor) de cada item na cadeia deve corresponder ao s: (assunto) do próximo item.

Neste caso eu coloquei o certificado em seu próprio arquivo, e coloquei no arquivo chain. Portanto, 0i não correspondeu a 1s . Isso foi o suficiente para fazer o svn rejeitar o certificado.

Qualquer ordenação incorreta causa esse problema. Então, se você tivesse 2 e 3 o caminho errado, você teria erros de validação.