Closed michal-cech closed 1 year ago
While using prebuild tls-scan in version 1.5.0, it seems that the value of the issuer is being set incorrectly to the same value as subject.
issuer
subject
The result of tls-scan --connect twitter.com --cacert /etc/ssl/certs/ca-certificates.crt --pretty is:
tls-scan --connect twitter.com --cacert /etc/ssl/certs/ca-certificates.crt --pretty
{ "host": "twitter.com", "ip": "104.244.42.193", "port": 443, "elapsedTime": 38, "tlsVersion": "TLSv1.2", "cipher": "ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(128) Mac=AEAD", "tempPublicKeyAlg": "ECDH prime256v1", "tempPublicKeySize": 256, "secureRenego": true, "compression": "NONE", "expansion": "NONE", "sessionLifetimeHint": 7200, "x509ChainDepth": 2, "verifyCertResult": true, "verifyHostResult": true, "ocspStapled": false, "certificateChain": [ { "version": 3, "subject": "CN=twitter.com; O=Twitter, Inc.; L=San Francisco; ST=California; C=US", "issuer": "CN=twitter.com; O=Twitter, Inc.; L=San Francisco; ST=California; C=US", "subjectCN": "twitter.com", "subjectAltName": "DNS:twitter.com, DNS:www.twitter.com", "signatureAlg": "ecdsa-with-SHA384", "notBefore": "Feb 5 00:00:00 2023 GMT", "notAfter": "Feb 5 23:59:59 2024 GMT", "expired": false, "serialNo": "04:53:47:D1:33:42:4A:B1:A3:4F:B3:CD:4D:6A:3C:DC", "keyUsage": "Digital Signature critical", "extKeyUsage": "TLS Web Server Authentication, TLS Web Client Authentication", "publicKeyAlg": "ECC prime256v1", "publicKeySize": 256, "basicConstraints": "CA:FALSE", "subjectKeyIdentifier": "91:67:46:DA:C0:8B:B0:73:42:B3:E5:B7:6A:80:D1:08:B6:C3:20:5B", "sha1Fingerprint": "C3:9A:EA:C1:5F:4F:8C:FF:C4:40:36:00:F8:61:42:C2:65:11:95:D3" }, { "version": 3, "subject": "CN=DigiCert TLS Hybrid ECC SHA384 2020 CA1; O=DigiCert Inc; C=US", "issuer": "CN=DigiCert TLS Hybrid ECC SHA384 2020 CA1; O=DigiCert Inc; C=US", "subjectCN": "DigiCert TLS Hybrid ECC SHA384 2020 CA1", "signatureAlg": "sha384WithRSAEncryption", "notBefore": "Apr 14 00:00:00 2021 GMT", "notAfter": "Apr 13 23:59:59 2031 GMT", "expired": false, "serialNo": "07:F2:F3:5C:87:A8:77:AF:7A:EF:E9:47:99:35:25:BD", "keyUsage": "Digital Signature, Certificate Sign, CRL Sign critical", "extKeyUsage": "TLS Web Server Authentication, TLS Web Client Authentication", "publicKeyAlg": "ECC secp384r1", "publicKeySize": 384, "basicConstraints": "CA:TRUE, pathlen:0 critical", "subjectKeyIdentifier": "0A:BC:08:29:17:8C:A5:39:6D:7A:0E:CE:33:C7:2E:B3:ED:FB:C3:7A", "sha1Fingerprint": "AE:C1:3C:DD:5E:A6:A3:99:8A:EC:14:AC:33:1A:D9:6B:ED:BB:77:0F" } ] }
As you can see, the result claims that the issuer of the Twitter certificate is CN=twitter.com; O=Twitter, Inc.; L=San Francisco; ST=California; C=US which is wrong.
CN=twitter.com; O=Twitter, Inc.; L=San Francisco; ST=California; C=US
It seems that the problematic part is here: https://github.com/prbinu/tls-scan/blob/c9d9af41b9a4f8dd82f947a6363e3570cd9a5035/cert-parser.c#L862-L872:
@michal-cech, thank you for catching this critical bug. I will fix this shortly.
While using prebuild tls-scan in version 1.5.0, it seems that the value of the
issuer
is being set incorrectly to the same value assubject
.The result of
tls-scan --connect twitter.com --cacert /etc/ssl/certs/ca-certificates.crt --pretty
is:As you can see, the result claims that the issuer of the Twitter certificate is
CN=twitter.com; O=Twitter, Inc.; L=San Francisco; ST=California; C=US
which is wrong.It seems that the problematic part is here: https://github.com/prbinu/tls-scan/blob/c9d9af41b9a4f8dd82f947a6363e3570cd9a5035/cert-parser.c#L862-L872: