search

nabla-c0d3 / sslyze

Fast and powerful SSL/TLS scanning library.
GNU Affero General Public License v3.0
3.28k stars 455 forks source link

"CryptographyDeprecationWarning: Parsed a negative serial number, which is disallowed by RFC 5280" #656

Open thbar opened 4 months ago

thbar commented 4 months ago

Describe the bug

Things work as expected overall, but I get a warning, both on Mac Intel & Mac Silicon.

poetry run sslyze vagrant-$$REDACTED$$:443{192.168.33.14} --certinfo

/Users/thbar/Library/Caches/pypoetry/virtualenvs/ansible-REDACTED-py3.12/lib/python3.12/site-packages/sslyze/plugins/certificate_info/trust_stores/trust_store.py:55: CryptographyDeprecationWarning: Parsed a negative serial number, which is disallowed by RFC 5280. Loading this certificate will cause an exception in the next release of cryptography.
  self._x509_store = Store(load_pem_x509_certificates(self.path.read_text().encode("ascii")))

To Reproduce

It appears I have a reproduction with non-vagrant domains as well:

❯ poetry run sslyze www.google.fr --certinfo 

 CHECKING CONNECTIVITY TO SERVER(S)
 ----------------------------------

   www.google.fr:443         => 172.217.20.163 
/Users/thbar/Library/Caches/pypoetry/virtualenvs/ansible-REDACTED-py3.12/lib/python3.12/site-packages/sslyze/plugins/certificate_info/trust_stores/trust_store.py:55: CryptographyDeprecationWarning: Parsed a negative serial number, which is disallowed by RFC 5280. Loading this certificate will cause an exception in the next release of cryptography.
  self._x509_store = Store(load_pem_x509_certificates(self.path.read_text().encode("ascii")))

# SNIP

Expected behavior

Same output but without the warning.

Python environment (please complete the following information):

Additional context

Happy to provide additional output if needed!

janbrasna commented 3 months ago

It was added here:

Basically @pyca says "we don't like it so we're loud about it" but it was actually deemed correct to add that and keep it maintained (originally only "for some time" until all such certs get phased out, but it now seems there are some of these hardcoded in more root stores than originally thought, so I don't see them going away anytime soon…), what I don't like is the "Loading this certificate will cause an exception in the next release of cryptography" wording as no matter how I look at it, it's not true and should have been worded otherwise. Anyways it's going away at some point so it's good it raises warnings for now, to draw more attention to the issue…

More info:

So basically, yea, if there are no plans depending on cryptography beyond say v43 it's safe to ignore/silence this warning. Otherwise… plan accordingly;)

Ricky-Tigg commented 2 months ago

Hello. Same observavtion while executing sslyze --certinfo '[2607:f8b0:400a:807::2004]:443'.

nabla-c0d3 commented 1 month ago

Hi ! I agree that this a problem, but there isn't much that SSLyze can do about it - it's up to pyca. I would argue that they shouldn't remove support for negative serial numbers as it will break a bunch of tools (including SSLyze) for (to me) no obvious win.