Control: tags -1 wontfix
("notaproblem" would be a better tag description, since there is nothing
to fix in the package)
On 05/30/2015 05:26 PM, Philippe Grégoire wrote:
I was trying to download awesome's source from https://awesome.naquadah.org/
with wget when I received the "hasn't got a known issuer" error. It surprised me
since I got the page displayed in iceweasel without problems.
I exported the certificate (GlobalSign Domain Validation CA - SHA256 - G2) and
looked for it in /etc/ssl/certs, but it was missing.
"GlobalSign Domain Validation CA - SHA256 - G2" is not a root CA, but an
intermediate CA that the web server has not been configured to send, as
it should. This intermediate is signed by the root CA "GlobalSign Root
CA", which is included in ca-certificates.
https://support.globalsign.com/customer/portal/articles/1464460-domainssl-intermediate-certificates
$ openssl s_client -CApath /etc/ssl/certs -connect
awesome.naquadah.org:443
CONNECTED(00000003)
depth=0 C = FR, OU = Domain Control Validated, CN = naquadah.org
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C = FR, OU = Domain Control Validated, CN = naquadah.org
verify error:num=27:certificate not trusted
verify return:1
depth=0 C = FR, OU = Domain Control Validated, CN = naquadah.org
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
0 s:/C=FR/OU=Domain Control Validated/CN=naquadah.org
i:/C=BE/O=GlobalSign nv-sa/CN=GlobalSign Domain Validation CA -
SHA256 - G2
---
Server certificate
-----BEGIN CERTIFICATE-----
<..snip>
I found another identical error searching on this intermediate, which
does appear to have been corrected by the web server admins. This is
what the chain should look like when the intermediate is included:
https://github.com/ndmitchell/hoogle/issues/96
$ openssl s_client -CApath /etc/ssl/certs -connect wiki.haskell.org:443
CONNECTED(00000003)
depth=2 C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
verify return:1
depth=1 C = BE, O = GlobalSign nv-sa, CN = GlobalSign Domain Validation
CA - SHA256 - G2
verify return:1
depth=0 OU = Domain Control Validated, CN = *.haskell.org
verify return:1
---
Certificate chain
0 s:/OU=Domain Control Validated/CN=*.haskell.org
i:/C=BE/O=GlobalSign nv-sa/CN=GlobalSign Domain Validation CA -
SHA256 - G2
1 s:/C=BE/O=GlobalSign nv-sa/CN=GlobalSign Domain Validation CA -
SHA256 - G2
i:/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
<..snip>
I honestly have no idea precisely how various browsers inspect and
proactively include missing intermediates so that users see a green
lock, even when talking to misconfigured servers.
--
Kind regards,
Michael Shuler
--
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]
