https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298800
Bug ID: 298800
Summary: openssl fails with new ssl.com intermediate issuer
Product: Base System
Version: 14.5-STABLE
Hardware: Any
OS: Any
Status: New
Severity: Affects Many People
Priority: ---
Component: bin
Assignee: [email protected]
Reporter: [email protected]
SSL.com started to issue certificates from a new intermediate CA. OpenSSL
verification fails with error 20 (unable to get local issuer certificate) for
this CA, breaking for us DNScrypt-proxy2 as CloudFlare's
security.cloudflare-dns.com DoH resolver that we use as an upstream DNS got a
new TLS certificate from the offending issuer earlier today.
Of course it can be worked around, but it would be nice if the bundled OpenSSL
had the new intermediate CA cert in the local issuer list.
You can reproduce the problem with the following command:
openssl s_client -connect security.cloudflare-dns.com:443
CONNECTED(00000003)
depth=1 C = US, O = SSL Corporation, CN = SSL.com TLS Issuing ECC CA R2
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C = US, ST = California, L = San Francisco, O = "Cloudflare, Inc.", CN
= security.cloudflare-dns.com
verify return:1
---
Certificate chain
0 s:C = US, ST = California, L = San Francisco, O = "Cloudflare, Inc.", CN =
security.cloudflare-dns.com
i:C = US, O = SSL Corporation, CN = SSL.com TLS Issuing ECC CA R2
a:PKEY: id-ecPublicKey, 256 (bit); sigalg: ecdsa-with-SHA384
v:NotBefore: Sep 23 00:12:36 2026 GMT; NotAfter: Apr 9 00:12:36 2027 GMT
1 s:C = US, O = SSL Corporation, CN = SSL.com TLS Issuing ECC CA R2
i:C = GB, ST = Greater Manchester, L = Salford, O = Comodo CA Limited, CN =
AAA Certificate Services
a:PKEY: id-ecPublicKey, 384 (bit); sigalg: RSA-SHA256
v:NotBefore: Jun 21 00:00:00 2024 GMT; NotAfter: Dec 31 23:59:59 2028 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFNjCCBLugAwIBAgIQD7JbU+7Q1sEE70bnqj5sFzAKBggqhkjOPQQDAzBPMQsw
CQYDVQQGEwJVUzEYMBYGA1UECgwPU1NMIENvcnBvcmF0aW9uMSYwJAYDVQQDDB1T
U0wuY29tIFRMUyBJc3N1aW5nIEVDQyBDQSBSMjAeFw0yNjA5MjMwMDEyMzZaFw0y
NzA0MDkwMDEyMzZaMHsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlh
MRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMRkwFwYDVQQKDBBDbG91ZGZsYXJlLCBJ
bmMuMSQwIgYDVQQDDBtzZWN1cml0eS5jbG91ZGZsYXJlLWRucy5jb20wWTATBgcq
hkjOPQIBBggqhkjOPQMBBwNCAAQeqeRQBNhPz2FAhpaw0n75DARKBgq+TkRnYIGr
oVsz9bAu109u5aenWb5swr2xX7XjJu1yBFJSPFwg5QczIGIFo4IDSzCCA0cwDAYD
VR0TAQH/BAIwADAfBgNVHSMEGDAWgBROuVJasY9+1jBTQ+XKXaIEjEwU9DBqBggr
BgEFBQcBAQReMFwwOAYIKwYBBQUHMAKGLGh0dHA6Ly9jZXJ0LnNzbC5jb20vU1NM
LmNvbS1UTFMtSS1FQ0MtUjIuY2VyMCAGCCsGAQUFBzABhhRodHRwOi8vb2NzcHMu
c3NsLmNvbTB1BgNVHREEbjBsghtzZWN1cml0eS5jbG91ZGZsYXJlLWRucy5jb22C
HSouc2VjdXJpdHkuY2xvdWRmbGFyZS1kbnMuY29thwQBAAAChwQBAQEChxAmBkcA
RwAAAAAAAAAAABAChxAmBkcARwAAAAAAAAAAABESMCMGA1UdIAQcMBowCAYGZ4EM
AQICMA4GDCsGAQQBgqkwAQMBAjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH
AwEwPQYDVR0fBDYwNDAyoDCgLoYsaHR0cDovL2NybHMuc3NsLmNvbS9TU0wuY29t
LVRMUy1JLUVDQy1SMi5jcmwwHQYDVR0OBBYEFK9S/DLNsTVsWHEBRzRPs05jn3LS
MA4GA1UdDwEB/wQEAwIHgDCCAX8GCisGAQQB1nkCBAIEggFvBIIBawFpAHYATGPc
mOWcHauI9h6KPd6uj6tEozd7X5uUw/uhnPzBviYAAAGgy6SZ6AAABAMARzBFAiEA
ko0BP0yxd3Q21twYerNwMFYGsPhWXzvnHr6uXW/kwnACIEBqEUvF9iMcvOaWJ1xg
xPCkHOtPrVCYYEXT1vkuCaaqAHcA1tWNqdAXU/NqSqDHV0kCr+vH3CzTjNn3ZMgM
iRkenwIAAAGgy6SaMwAABAMASDBGAiEAjAIHGV3+MMEztrE1pFuTGbP9jPqF9mi2
BhBtY+rMyQcCIQDFB+D8Qx2tb9W8P4OvWPGjAqdx9jXfO03nbIk3Of0hsQB2AEai
OWfGDbZGh8ZvPfmZlHaTpqYRIIRX1VXn49Ch2bZGAAABoMukmh0AAAQDAEcwRQIh
AN/hX0u3YMVu8crr32WiZocjeIvPXa0nobpOpK1jNrETAiA0owSv5a6ZbeMrCsr7
CJk+Iv93nuMaT9tCncRGy7RPWTAKBggqhkjOPQQDAwNpADBmAjEAzzQbu8QyMjgo
726dwUhNTvzl5iWLhIKHiMpnzxNCCVqr+VhZ6Z1ZEnuPNE2ylCuMAjEAyuervjti
i+CAsfxbxiwp+dOn1RcZlvxgq3CqBsIP7F67IFhEPMlexu2Ozv6++P4s
-----END CERTIFICATE-----
subject=C = US, ST = California, L = San Francisco, O = "Cloudflare, Inc.", CN
= security.cloudflare-dns.com
issuer=C = US, O = SSL Corporation, CN = SSL.com TLS Issuing ECC CA R2
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: ECDSA
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 2630 bytes and written 413 bytes
Verification error: unable to get local issuer certificate
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 256 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 20 (unable to get local issuer certificate)
---
--
You are receiving this mail because:
You are the assignee for the bug.
