Mailing List Archive: Apache: Bugs

[Bug 47329] SSLCADNRequest* & SSLCACertificate* silently do not work with 'Trusted' certificates

Index | Next | Previous | View Threaded

bugzilla at apache

Jun 24, 2009, 8:29 AM

Post #1 of 6 (648 views)
Permalink

*[Bug 47329] SSLCADNRequest & SSLCACertificate* silently do not work with 'Trusted' certificates**

https://issues.apache.org/bugzilla/show_bug.cgi?id=47329

tlhackque [at] yahoo changed:

What |Removed |Added
----------------------------------------------------------------------------
Summary|SSLCADNRequest* & |SSLCADNRequest* &
|SSLCACertificate* |SSLCACertificate* silently
|defficiency |do not work with 'Trusted'
| |certificates

--- Comment #2 from tlhackque [at] yahoo 2009-06-24 08:29:35 PST ---
The more I think about this, the more convinced I become that an error message
(or a fix) is required.

The user is supplying a valid certificate that httpd is not able to process.
Httpd doesn't behave as expected.

I lived without the correct information being sent to by clients' browsers for
several years (yes, years) until I was finally able to get traces showing that
the valid CA messages weren't being sent. It was particularly confusing as an
administrator, as when using SSLCACertificate*, the certificate was used
correctly by httpd for one purpose, but not for another. And of course, it
only really impacts clients with more than one certificate to send...

While the documentation should be improved, I don't think that's sufficient.

Arguably this can be pushed upstream to OpenSSL, as HTTPD seems to just pass
the filename along. Or HTTPD can validate the certificate itself. But
someone, somewhere in the chain needs to detect this error, and httpd needs to
ultimately report it. Silently ignoring a valid certificate isn't acceptable.

--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe [at] httpd
For additional commands, e-mail: bugs-help [at] httpd

bugzilla at apache

Jun 25, 2009, 1:54 AM

Post #2 of 6 (604 views)
Permalink

*[Bug 47329] SSLCADNRequest & SSLCACertificate* silently do not work with 'Trusted' certificates** [In reply to]

https://issues.apache.org/bugzilla/show_bug.cgi?id=47329

--- Comment #3 from Joe Orton <jorton [at] redhat> 2009-06-25 01:54:22 PST ---
Created an attachment (id=23876)
--> (https://issues.apache.org/bugzilla/attachment.cgi?id=23876)
test patch

If you apply this patch, do you get errors logged when loading the bogus certs?

--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe [at] httpd
For additional commands, e-mail: bugs-help [at] httpd

bugzilla at apache

Jun 25, 2009, 5:34 AM

Post #3 of 6 (608 views)
Permalink

*[Bug 47329] SSLCADNRequest & SSLCACertificate* silently do not work with 'Trusted' certificates** [In reply to]

https://issues.apache.org/bugzilla/show_bug.cgi?id=47329

--- Comment #4 from tlhackque [at] yahoo 2009-06-25 05:34:03 PST ---
Thanks, that's progress:

I commented-out SSLCADNRequestFile (leaving it to default to
SSLCACertificateFile, which has the trust).

Now get these errors, and httpd doesn't start:

[Thu Jun 25 08:08:12 2009] [error] SSL Library Error: 151441516
error:0906D06C:PEM routines:PEM_read_bio:no start line Bad file contents or
format - or even just a forgotten SSLCertificateKeyFile?
[Thu Jun 25 08:08:12 2009] [error] SSL Library Error: 151441516
error:0906D06C:PEM routines:PEM_read_bio:no start line Bad file contents or
format - or even just a forgotten SSLCertificateKeyFile?

Not sure why I get two errors, but two is better than none!

If I re-enable SSLCADNRequestFile, neither error appears and httpd starts
normally.

Would be great if it reported the directive & filename; ideal if also the
config filename/locn.

I'll attach a .zip file with both certificates to facilitate testing.

Thanks for your help. I'm sure this will save other people some pain &
suffering!

--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe [at] httpd
For additional commands, e-mail: bugs-help [at] httpd

bugzilla at apache

Jun 25, 2009, 5:39 AM

Post #4 of 6 (600 views)
Permalink

*[Bug 47329] SSLCADNRequest & SSLCACertificate* silently do not work with 'Trusted' certificates** [In reply to]

https://issues.apache.org/bugzilla/show_bug.cgi?id=47329

--- Comment #5 from tlhackque [at] yahoo 2009-06-25 05:39:43 PST ---
Created an attachment (id=23878)
--> (https://issues.apache.org/bugzilla/attachment.cgi?id=23878)
Certificates that exhibit this problem

Here is the trusted certificate & the same certificate with trust removed
(using the perl script previously attached.) You can use these to validate
your patch.

Archive: 47329.zip
Length Method Size Ratio Date Time CRC-32 Name
-------- ------ ------- ----- ---- ---- ------ ----
1996 Defl:N 1019 49% 09-04-07 09:36 1551832f
etc/pki/tls/ca/litts_net_ca-cert.pem
2262 Defl:N 1150 49% 06-07-09 09:38 8916e5cb
etc/pki/tls/certs/litts_net_client_cas.pem
-------- ------- --- -------
4258 2169 49% 2 files

openssl x509 -noout -text -in /etc/pki/tls/ca/litts_net_ca-cert.pem -out t1.tmp
openssl x509 -noout -text -in /etc/pki/tls/certs/litts_net_client_cas.pem -out
t2.tmp
diff t1.tmp t2.tmp
60,63d59
< Trusted Uses:
< TLS Web Client Authentication, TLS Web Server Authentication, E-mail
Protection
< No Rejected Uses.
< Alias: litts.net Primary Certification Authority

--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe [at] httpd
For additional commands, e-mail: bugs-help [at] httpd

bugzilla at apache

Jun 25, 2009, 1:59 PM

Post #5 of 6 (597 views)
Permalink

*[Bug 47329] SSLCADNRequest & SSLCACertificate* silently do not work with 'Trusted' certificates** [In reply to]

https://issues.apache.org/bugzilla/show_bug.cgi?id=47329

--- Comment #6 from tlhackque [at] yahoo 2009-06-25 13:59:03 PST ---
(Follow-up to comment #4)
Two errors >are< expected - I have two virtual hosts in the server that I
tested; a common included config file supplies these directives.

You've definitely caught the error; if the output were a bit cleaner (and the
doc updated), I'd be very happy with the fix.

Thanks again for your efforts.

--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe [at] httpd
For additional commands, e-mail: bugs-help [at] httpd

bugzilla at apache

Jun 27, 2009, 2:12 AM

Post #6 of 6 (587 views)
Permalink

*[Bug 47329] SSLCADNRequest & SSLCACertificate* silently do not work with 'Trusted' certificates** [In reply to]

https://issues.apache.org/bugzilla/show_bug.cgi?id=47329

tlhackque [at] yahoo changed:

What |Removed |Added
----------------------------------------------------------------------------
Attachment #23876|0 |1
is obsolete| |

--- Comment #7 from tlhackque [at] yahoo 2009-06-27 02:12:26 PST ---
Created an attachment (id=23889)
--> (https://issues.apache.org/bugzilla/attachment.cgi?id=23889)
Patch with better error report

There may be a better way to code it, but here's a version of the test patch
that reports the offending filename, as in:

[Sat Jun 27 04:59:39 2009] [error] Failed to load client CA certificate from
/etc/pki/tls/ca/litts_net_ca-cert.pem, SSL library error:
[Sat Jun 27 04:59:39 2009] [error] SSL Library Error: 151441516
error:0906D06C:PEM routines:PEM_read_bio:no start line Bad file contents or
format - or even just a forgotten SSLCertificateKeyFile?

I'm not sure how to get back to the config file/directive, but at least this
gives the filename and why it's being loaded...

--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe [at] httpd
For additional commands, e-mail: bugs-help [at] httpd

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads