gmane.network.gnutls.general

Re: Re: gnutls_certificate_verify_peers2() / GNUTLS_CERT_INVALID

I mangled the names (## in their places) because this is a cert I
received from a user:

[root <at> rgf9dev nick]# certtool -i < cert.pem
X.509 Certificate Information:
	Version: 3
	Serial Number (hex): 485a73f4
	Issuer: C=US,O=###Host,OU=Online,L=##,ST=##,CN=######.com
	Validity:
		Not Before: Thu Jun 19 14:57:58 UTC 2008
		Not After: Wed Mar 16 14:58:01 UTC 2011
	Subject: C=US,O=######,OU=Online,L=######,ST=##,CN=######.com
	Subject Public Key Algorithm: RSA
		Modulus (bits 2048):
			ac:ad:f0:eb:35:6b:9e:41:e9:6a:67:03:ed:2c:12:6e
			00:ea:ae:ea:10:2a:bd:52:00:4a:2d:d3:55:77:20:b6
			dd:78:97:e3:83:4d:19:f8:64:af:7d:58:e7:b3:bb:92
			05:92:0e:38:9b:98:2e:55:44:74:3b:af:24:65:33:f8
			42:d6:76:b5:f2:97:dc:8c:e8:b5:ae:a6:1d:17:71:62
			16:cc:db:1c:78:ae:a2:53:78:7a:88:3e:b0:85:ce:4f
			3b:e9:76:53:db:6f:f4:40:99:24:91:ec:b9:ab:40:76
			66:de:21:3e:36:1b:7c:ff:7e:ca:0c:9f:e8:5c:52:84
			3d:cb:51:41:db:30:89:c9:0c:95:f1:da:d2:d7:4f:30
			73:2b:00:a5:e2:a0:da:27:84:6c:db:03:11:8c:a3:16
			3c:2d:48:30:c7:a3:0a:26:ea:68:4a:c2:e8:7e:e0:ae
			6a:66:c3:80:d3:38:66:8f:49:37:c8:af:01:10:aa:f0
			cf:59:73:55:44:e9:99:ba:a2:9f:3c:42:91:06:02:04
			6b:f8:76:da:21:31:66:77:af:64:1b:48:59:62:59:7e
			28:bd:4e:99:76:6d:bf:b1:09:78:32:6e:e2:16:4b:67
			fc:06:5f:86:e4:18:54:cb:01:5a:5f:74:81:b5:98:5f

(Continue reading)

headers

Rainer Gerhards | 20 Jun 10:40

Re: Re: gnutls_certificate_verify_peers2() / GNUTLS_CERT_INVALID

Some more info: asn1_read_value returns ASN1_ELEMENT_NOT_FOUND. The
value in question is "pathLenConstraint", node is a non-NULL value (I
put a printf() in _gnutls_x509_read_uint()).

Rainer

On Fri, Jun 20, 2008 at 10:26 AM, Rainer Gerhards <rgerhards <at> gmail.com> wrote:
> I mangled the names (## in their places) because this is a cert I
> received from a user:
>
> [root <at> rgf9dev nick]# certtool -i < cert.pem
> X.509 Certificate Information:
>        Version: 3
>        Serial Number (hex): 485a73f4
>        Issuer: C=US,O=###Host,OU=Online,L=##,ST=##,CN=######.com
>        Validity:
>                Not Before: Thu Jun 19 14:57:58 UTC 2008
>                Not After: Wed Mar 16 14:58:01 UTC 2011
>        Subject: C=US,O=######,OU=Online,L=######,ST=##,CN=######.com
>        Subject Public Key Algorithm: RSA
>                Modulus (bits 2048):
>                        ac:ad:f0:eb:35:6b:9e:41:e9:6a:67:03:ed:2c:12:6e
>                        00:ea:ae:ea:10:2a:bd:52:00:4a:2d:d3:55:77:20:b6
>                        dd:78:97:e3:83:4d:19:f8:64:af:7d:58:e7:b3:bb:92
>                        05:92:0e:38:9b:98:2e:55:44:74:3b:af:24:65:33:f8
>                        42:d6:76:b5:f2:97:dc:8c:e8:b5:ae:a6:1d:17:71:62
>                        16:cc:db:1c:78:ae:a2:53:78:7a:88:3e:b0:85:ce:4f
>                        3b:e9:76:53:db:6f:f4:40:99:24:91:ec:b9:ab:40:76
>                        66:de:21:3e:36:1b:7c:ff:7e:ca:0c:9f:e8:5c:52:84
>                        3d:cb:51:41:db:30:89:c9:0c:95:f1:da:d2:d7:4f:30

(Continue reading)

headers

Rainer Gerhards | 20 Jun 11:39

Re: Re: gnutls_certificate_verify_peers2() / GNUTLS_CERT_INVALID

Just some more info: the certificate was generated with GnuTLS 2.3.11
on CentOS (in case that helps ;)).

Rainer

On Fri, Jun 20, 2008 at 10:40 AM, Rainer Gerhards <rgerhards <at> gmail.com> wrote:
> Some more info: asn1_read_value returns ASN1_ELEMENT_NOT_FOUND. The
> value in question is "pathLenConstraint", node is a non-NULL value (I
> put a printf() in _gnutls_x509_read_uint()).
>
> Rainer
>
> On Fri, Jun 20, 2008 at 10:26 AM, Rainer Gerhards <rgerhards <at> gmail.com> wrote:
>> I mangled the names (## in their places) because this is a cert I
>> received from a user:
>>
>> [root <at> rgf9dev nick]# certtool -i < cert.pem
>> X.509 Certificate Information:
>>        Version: 3
>>        Serial Number (hex): 485a73f4
>>        Issuer: C=US,O=###Host,OU=Online,L=##,ST=##,CN=######.com
>>        Validity:
>>                Not Before: Thu Jun 19 14:57:58 UTC 2008
>>                Not After: Wed Mar 16 14:58:01 UTC 2011
>>        Subject: C=US,O=######,OU=Online,L=######,ST=##,CN=######.com
>>        Subject Public Key Algorithm: RSA
>>                Modulus (bits 2048):
>>                        ac:ad:f0:eb:35:6b:9e:41:e9:6a:67:03:ed:2c:12:6e
>>                        00:ea:ae:ea:10:2a:bd:52:00:4a:2d:d3:55:77:20:b6
>>                        dd:78:97:e3:83:4d:19:f8:64:af:7d:58:e7:b3:bb:92

(Continue reading)

headers

Nikos Mavrogiannopoulos | 20 Jun 18:03

Re: Re: gnutls_certificate_verify_peers2() / GNUTLS_CERT_INVALID

Rainer Gerhards wrote:
> Just some more info: the certificate was generated with GnuTLS 2.3.11
> on CentOS (in case that helps ;)).

And on which version is the read being done?

headers

Nikos Mavrogiannopoulos | 22 Jun 12:52

Re: Re: gnutls_certificate_verify_peers2() / GNUTLS_CERT_INVALID

Rainer Gerhards wrote:
> Some more info: asn1_read_value returns ASN1_ELEMENT_NOT_FOUND. The
> value in question is "pathLenConstraint", node is a non-NULL value (I
> put a printf() in _gnutls_x509_read_uint()).

>>>> 5292.675380113:main queue:Reg/w0: GnuTLS log msg, level 2: ASSERT: verify.c:301
>>>>
>>>> 5292.741284540:main queue:Reg/w0: GnuTLS log msg, level 2: ASSERT: dn.c:1212
>>>>
>>>> 5292.744965838:main queue:Reg/w0: GnuTLS log msg, level 2: ASSERT: verify.c:395
>>>>
>>>> 5292.751276475:main queue:Reg/w0: GnuTLS returned no specific reason
>>>> for GNUTLS_CERT_INVALID, certificate status is 2

As far as I understand here the verification correctly does not succeed
because some DN's do not match. If you still think it is a gnutls bug,
please send a way for me to reproduce this problem (a chain of
certificates that should verify, and the way to produce them).

However I'd say to check if the certificate chain is correctly send etc.

regards,
Nikos

headers

Rainer Gerhards | 23 Jun 08:30

Re: Re: gnutls_certificate_verify_peers2() / GNUTLS_CERT_INVALID

Hi Nikos,

On Sun, Jun 22, 2008 at 12:52 PM, Nikos Mavrogiannopoulos
<nmav <at> gnutls.org> wrote:
> Rainer Gerhards wrote:
>> Some more info: asn1_read_value returns ASN1_ELEMENT_NOT_FOUND. The
>> value in question is "pathLenConstraint", node is a non-NULL value (I
>> put a printf() in _gnutls_x509_read_uint()).
>
>>>>> 5292.675380113:main queue:Reg/w0: GnuTLS log msg, level 2: ASSERT: verify.c:301
>>>>>
>>>>> 5292.741284540:main queue:Reg/w0: GnuTLS log msg, level 2: ASSERT: dn.c:1212
>>>>>
>>>>> 5292.744965838:main queue:Reg/w0: GnuTLS log msg, level 2: ASSERT: verify.c:395
>>>>>
>>>>> 5292.751276475:main queue:Reg/w0: GnuTLS returned no specific reason
>>>>> for GNUTLS_CERT_INVALID, certificate status is 2
>
> As far as I understand here the verification correctly does not succeed
> because some DN's do not match.

Could you elaborate on this? As far as I understood (what may be
wrong) there is no inter-dependency between the DNs. Is there some
that I have not seen?

> If you still think it is a gnutls bug,

I am not even sure it is a bug. My initial question was what this may
have caused. I am still trying to track down the actual problem cause,
but the error message is so generic that I have no clue where I should

(Continue reading)

headers

nickg | 20 Jun 19:46

Re: Re: gnutls_certificate_verify_peers2() / GNUTLS_CERT_I

Yassou Nikos,

The Certificate Authority, the client, and the server reading the server
are all using GNUTLS 2.3.11 and the CentOS version is 4.6 for all three as
well.

This problem is also happening on Ubuntu with GnuTLS 2.0.4 and 2.3.11.

Any ideas  you have are greatly appreciated.

Fcaristo Poli!
Nick