Open yodatak opened 4 years ago
From an initial glance it seems this might even bubble up from OpenSSL itself into cryptography
.
Does running openssl x509 -in /etc/ssl/certs/ca_multisite_chain_complete.pem -text -noout
on that host show something unusual or some errors?
Cool usage of the module by the way! :-)
Hi no error here openssl x509 -in /etc/ssl/certs/ca_multisite_chain_complete.pem -text -noout Certificate: Data: Version: 3 (0x2) Serial Number: XXXXXXXXXXXXXXXXXXXXXX Signature Algorithm: sha1WithRSAEncryption Issuer: C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root Validity Not Before: Dec 1 00:00:00 2005 GMT Not After : Jun 24 19:06:30 2019 GMT Subject: XXXXXXXXXXXXXXXXXXXXXXXXXX INTERNET CA, CN=TBS X509 CA pro hosting Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: XXXXXX Exponent: XXXX X509v3 extensions: X509v3 Subject Key Identifier: XXXXXXXXXXXXXXX X509v3 Key Usage: critical Certificate Sign, CRL Sign X509v3 Basic Constraints: critical CA:TRUE, pathlen:0 X509v3 Extended Key Usage: Microsoft Server Gated Crypto, Netscape Server Gated Crypto X509v3 Certificate Policies: XXXXXXXXXXXXXXX 0.0 X509v3 CRL Distribution Points:
Full Name:
URI:http://crl.comodoca.com/AddTrustExternalCARoot.crl
Full Name:
URI:http://crl.comodo.net/AddTrustExternalCARoot.crl
Authority Information Access:
CA Issuers - URI:http://crt.comodoca.com/AddTrustUTNSGCCA.crt
CA Issuers - URI:http://crt.comodo.net/AddTrustUTNSGCCA.crt
Netscape Cert Type:
SSL CA
Signature Algorithm: sha1WithRSAEncryption
XXXXXXXXXXXXXXX
cryptography sometimes bundles its own libssl (depending on how you install it), so it could be that it is more strict. Anyway, this error is either caused by OpenSSL, by cryptography, or by the certificate (or by a combination of them). Without having access to the certificate itself, it's impossible for us to debug this further (and you probably won't have more success if you file this issue directly with cryptography).
How I can i send you the certificate in a private way ?
You can send it by email to my email address (felix
at fontein
dot de
).
@yodatak thanks for sending me the certificates. The problem is that they contain something for the X509v3 Certificate Policies
extension that is invalid. You can see that already when using openssl x509 -noout -text -in /path/to/cert.pem
. If the extension would be correct, the printout should look like:
X509v3 Certificate Policies:
Policy: 2.23.140.1.2.1
Policy: 1.3.6.1.4.1.44947.1.1.1
CPS: http://cps.root-x1.letsencrypt.org
If openssl cannot parse an extension, it simply dumps the binary data, and you get the output that it is showing for your certificate (which you unfortunately censored in the output in this issue):
X509v3 Certificate Policies:
0M0[snip]....
I removed most of the content to avoid this identifying anything. It is clear from the leftovers though that this is not generated by https://github.com/openssl/openssl/blob/master/crypto/x509/v3_cpols.c#L405-L423, which it would be if the output would be parsable.
I looked at the certificate with https://lapo.it/asn1js/ (will not make network requests to the server, so your certificate is safe) and compared it to certificates that could be parsed. For my eyes, it looks like the certificate is correct according to https://tools.ietf.org/html/rfc5280#section-4.2.1.4. So this is probably a bug in OpenSSL's ASN.1 parser.
You should file an issue in https://github.com/openssl/openssl/ (the visible issue being that openssl x509 -in /path/to/cert -noout -text
cannot process the extension, the underlying problem that OpenSSL cannot parse the X509v3 Certificate Policies extension). I'm not familiar with their issue process, but you'll probably also be asked to send them the certificate(s) which produce this error. See https://github.com/openssl/openssl/blob/master/SUPPORT.md#you-found-a-bug (I've already searched a bit through their issues and couldn't find anything related).
SUMMARY
When verify all the file in /etc/ssl/certs i got this error
ISSUE TYPE
COMPONENT NAME
x509_certificate_info
ANSIBLE VERSION
CONFIGURATION
OS / ENVIRONMENT
Red Hat 7.3 python2
STEPS TO REPRODUCE
EXPECTED RESULTS
Verify certificate
ACTUAL RESULTS
it append on 2 files /etc/ssl/certs/multisite_XXX.cer and ca_multisite_chain_complete.pem