jannau
commented
2 years ago On June 14th Apple's CDN used an intermediate cert that was signed by an old GeoTrust / Symantec certificate that was universally distrusted a couple of years ago. AS3320 (Germany). Today is signed by a by Cybertrust root certificate and the verification succeeds.
echo | openssl s_client -showcerts -connect updates.cdn-apple.com:https
CONNECTED(00000003)
depth=1 CN = Apple IST CA 8 - G1, OU = Certification Authority, O = Apple Inc., C = US
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = updates.cdn-apple.com, O = Apple Inc., ST = California, C = US
verify return:1
---
Certificate chain
0 s:CN = updates.cdn-apple.com, O = Apple Inc., ST = California, C = US
i:CN = Apple IST CA 8 - G1, OU = Certification Authority, O = Apple Inc., C = US
-----BEGIN CERTIFICATE-----
MIIGezCCBiGgAwIBAgIQHOg1skGYHay+dsf/JKSZMTAKBggqhkjOPQQDAjBiMRww
GgYDVQQDDBNBcHBsZSBJU1QgQ0EgOCAtIEcxMSAwHgYDVQQLDBdDZXJ0aWZpY2F0
aW9uIEF1dGhvcml0eTETMBEGA1UECgwKQXBwbGUgSW5jLjELMAkGA1UEBhMCVVMw
HhcNMjIwNjEzMTY1NDMyWhcNMjMwNzEzMTY1NDMxWjBXMR4wHAYDVQQDDBV1cGRh
dGVzLmNkbi1hcHBsZS5jb20xEzARBgNVBAoMCkFwcGxlIEluYy4xEzARBgNVBAgM
CkNhbGlmb3JuaWExCzAJBgNVBAYTAlVTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD
QgAEsTXluPYDh2xVLDFk4y0P/dAk2Ec4IyANYzgFJ6GW5geFgz2joRbV3AnDXM0P
vKVlxPlYBieXQ1vAjO9N6CWiw6OCBMIwggS+MAwGA1UdEwEB/wQCMAAwHwYDVR0j
BBgwFoAUw8SkWAVj14MGupaN3LKPMva7t0EwgbkGCCsGAQUFBwEBBIGsMIGpMDcG
CCsGAQUFBzAChitodHRwOi8vY2VydHMuYXBwbGUuY29tL2FwcGxlaXN0Y2E4ZzFf
YmMuY2VyMDQGCCsGAQUFBzAChihodHRwOi8vY2VydHMuYXBwbGUuY29tL2FwcGxl
aXN0Y2E4ZzEuZGVyMDgGCCsGAQUFBzABhixodHRwOi8vb2NzcC5hcHBsZS5jb20v
b2NzcDAzLWFwcGxlaXN0Y2E4ZzExMTAgBgNVHREEGTAXghV1cGRhdGVzLmNkbi1h
cHBsZS5jb20wggEHBgNVHSAEgf8wgfwwCAYGZ4EMAQICMIHvBgoqhkiG92NkBQsE
MIHgMDcGCCsGAQUFBwIBFitodHRwczovL3d3dy5hcHBsZS5jb20vY2VydGlmaWNh
dGVhdXRob3JpdHkvMIGkBggrBgEFBQcCAjCBlwyBlFJlbGlhbmNlIG9uIHRoaXMg
Y2VydGlmaWNhdGUgYnkgYW55IHBhcnR5IGFzc3VtZXMgYWNjZXB0YW5jZSBvZiBh
bnkgYXBwbGljYWJsZSB0ZXJtcyBhbmQgY29uZGl0aW9ucyBvZiB1c2UgYW5kL29y
IGNlcnRpZmljYXRpb24gcHJhY3RpY2Ugc3RhdGVtZW50cy4wEwYDVR0lBAwwCgYI
KwYBBQUHAwEwNwYDVR0fBDAwLjAsoCqgKIYmaHR0cDovL2NybC5hcHBsZS5jb20v
YXBwbGVpc3RjYThnMS5jcmwwHQYDVR0OBBYEFE92xCAs+hIYUSy13NIUCwztiW9r
MA4GA1UdDwEB/wQEAwIDiDAsBgoqhkiG92NkBjABBB4MHDEuMi44NDAuMTEzNjM1
LjEwMC42LjI3LjQwLjIwggH3BgorBgEEAdZ5AgQCBIIB5wSCAeMB4QB3ALNzdwfh
hFD4Y4bWBancEQlKeS2xZwwLh9zwAw55NqWaAAABgV4GMugAAAQDAEgwRgIhAISK
QA7HkLz2No0AEeskxW+8RvhfnT8lR25gZlW9IRxRAiEA+WEIfldauBCo+gfNzSIk
Y256cDwIlGC0dUsarB2jxKEAdwDoPtDaPvUGNTLnVyi8iWvJA9PL0RFr7Otp4Xd9
bQa9bgAAAYFeBjMgAAAEAwBIMEYCIQDPlCx9lD+lSRrPXxnrkuVxQUR2+dpbpMp7
veEK+pQhWAIhAPDBtSYLuOQNOjfNYnxeZ12Z2ssDEujlAX9VHB0rbMDZAHUAejKM
VNi3LbYg6jjgUh7phBZwMhOFTTvSK8E6V6NS61IAAAGBXgYzfAAABAMARjBEAiAQ
BdHdbOvG/iyohOMz9AgHAaQrjjq9rynE2DTu0kytlwIgQYmfpoI9x98Jcoib7kTI
t+EF7TvMfohOsMEwfon3O6wAdgA1zxkbv7FsV78PrUxtQsu7ticgJlHqP+Eq76gD
wzvWTAAAAYFeBjNwAAAEAwBHMEUCIQCWa++2rusPSzG3UT5i9WXTr4x+pE7fGKeX
UvMsNOgqNQIgQ9W7Jr/a9JNFKx+QYSrnC5dD278HuCr3Zf2cfVc0BwAwCgYIKoZI
zj0EAwIDSAAwRQIhAM4gjPPI3lHEXafyG29CCKwE/8/vzV1OO3Rrw32FAYn3AiAb
kqPHnkeang4C4rLIItpEtOwSpq6PMYloVPQg3i8nlQ==
-----END CERTIFICATE-----
1 s:CN = Apple IST CA 8 - G1, OU = Certification Authority, O = Apple Inc., C = US
i:C = US, O = GeoTrust Inc., OU = (c) 2007 GeoTrust Inc. - For authorized use only, CN = GeoTrust Primary Certification Authority - G2
-----BEGIN CERTIFICATE-----
MIIDVDCCAtugAwIBAgIQE1Iuv8HdXOEe8nZAdR/n3zAKBggqhkjOPQQDAzCBmDEL
MAkGA1UEBhMCVVMxFjAUBgNVBAoTDUdlb1RydXN0IEluYy4xOTA3BgNVBAsTMChj
KSAyMDA3IEdlb1RydXN0IEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTE2
MDQGA1UEAxMtR2VvVHJ1c3QgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0
eSAtIEcyMB4XDTE2MDYwOTAwMDAwMFoXDTMxMDYwODIzNTk1OVowYjEcMBoGA1UE
AwwTQXBwbGUgSVNUIENBIDggLSBHMTEgMB4GA1UECwwXQ2VydGlmaWNhdGlvbiBB
dXRob3JpdHkxEzARBgNVBAoMCkFwcGxlIEluYy4xCzAJBgNVBAYTAlVTMFkwEwYH
KoZIzj0CAQYIKoZIzj0DAQcDQgAELVSOaLAQE+/0LdvYCbJD6J1lmW40uNSXyY7J
1qgiNzLIcWDusPHyxWT2ukdf/OYHeDIt9sqAIMn9cPhykyGIRaOCATowggE2MBIG
A1UdEwEB/wQIMAYBAf8CAQAwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2cuc3lt
Y2IuY29tL0dlb1RydXN0UENBLUcyLmNybDAOBgNVHQ8BAf8EBAMCAQYwLgYIKwYB
BQUHAQEEIjAgMB4GCCsGAQUFBzABhhJodHRwOi8vZy5zeW1jZC5jb20wSQYDVR0g
BEIwQDA+BgZngQwBAgIwNDAyBggrBgEFBQcCARYmaHR0cHM6Ly93d3cuZ2VvdHJ1
c3QuY29tL3Jlc291cmNlcy9jcHMwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUF
BwMCMB0GA1UdDgQWBBTDxKRYBWPXgwa6lo3cso8y9ru3QTAfBgNVHSMEGDAWgBQV
XzVXUVX7JbKtA2n8AaP6vhFV1TAKBggqhkjOPQQDAwNnADBkAjBH2jMNybjCk3Ts
OidXxJX9YDPMd5S3KDCv8vyTdJGhtoly7fQJRNv5rnVz+6YGfsMCMEp6wyheL7NK
mqavsduix2R+j1B3wRjelzJYgXzgM3nwhQKKlJWxpF7IGHuva1taxg==
-----END CERTIFICATE-----
---
Server certificate
subject=CN = updates.cdn-apple.com, O = Apple Inc., ST = California, C = US
issuer=CN = Apple IST CA 8 - G1, OU = Certification Authority, O = Apple Inc., C = US
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: ECDSA
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 2883 bytes and written 387 bytes
Verification error: unable to get local issuer certificate
---
New, TLSv1.3, Cipher is TLS_AES_128_GCM_SHA256
Server public key is 256 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 20 (unable to get local issuer certificate)
---
DONE
op06072
marcan
If your issue got duped to this one: please mention your country, network type (home, corporate, educational, mobile), whether your Mac is running any MDM/device tracking type software, and then run the following command and paste the full output.
openssl s_client -showcerts -connect updates.cdn-apple.com:443 < /dev/nullUnclear if this is due to missing legitimate certs in our bundle, missing dubious certs in our bundle (e.g. country CAs which we don't ship), or people being blatantly MITMed by their network.