search

agl / xmpp-client

An XMPP client with OTR support
BSD 3-Clause "New" or "Revised" License
365 stars 71 forks source link

CaCert root certificate uses the insecure MD5WithRSA signature algorithm. #109

Closed sycamoreone closed 8 years ago

sycamoreone commented 8 years ago

The CACert root certificate included in xmpp-client uses the MD5WithRSA signature algorithm. This is not only no longer thought to be secure, but is also not supported by Go. Connecting to jabber.ccc.de now gives the following error:

xmpp: failed to verify TLS certificate: x509: certificate signed by unknown authority (possibly because of "x509: cannot verify signature: insecure algorithm MD5-RSA" while trying to verify candidate authority certificate "CA Cert Signing Authority")

(This issue comes originally from Coy: twstrike/coyim/issues/41)

agl commented 8 years ago

The hash algorithm used in the self-signature of a root CA is irrelevant for security. However it also shouldn't trigger a verification error. Rather it looks like that error is arising because the CACert authority isn't found.

Also, I can't reproduce an error when connecting to jabber.ccc.de with Go master.

agl commented 8 years ago

I think this was caused by a bug in xmpp-client which should be fixed in 525bd26cf5f56ec5aee99464714fd1d019c119ff.