12.04/openssl refusing some verisign certified sites
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
OpenSSL |
Confirmed
|
Unknown
|
|||
ca-certificates (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
openssl (Ubuntu) |
Invalid
|
Undecided
|
Unassigned |
Bug Description
Summary: SSL refuses to work with some https sites on both 12.04, 13.04, 13.10, for fresh and updated installations. It is an issue with OpenSSL's handling of certificates..
FIX:
Fixed in Ubuntu 14.04 apparently.
Openssl upstream, see http://
WORKAROUND:
1) Copy the Root CA from Symantec's website https:/
2) Paste the contents into a file under "/usr/local/
$ sudo vi /usr/local/
$ sudo update-
# You should see output similar to this:
Updating certificates in /etc/ssl/certs... 1 added, 0 removed; done.
Running hooks in /etc/ca-
---- Original post ----
After upgrading a 10.04 server to 12.04, SSL refuses to work with some sites.
On 10.04,
curl -v https:/
works fine, on 12.04 it says:
error:14090086:SSL routines:
This happens on some very well know bank sites , another example is https:/
Hence I think
Analysis:
- test on an 10.04 upgraded to 12.04 and also a 12.04 fresh server installation
- curl/7.22.0 (x86_64-
- Calling ssl directly:
openssl s_client -host cs.directnet.com -port 443
says "self signed certificate in certificate chain", and the chain shown is:
Certificate chain
0 s:/1.3.
i:/C=
1 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https:/
i:/C=
2 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5
i:/C=
3 s:/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority
i:/C=
Now there are lots of certificates in /usr/share/
Search the existing openssl/12.04 issues I came across ciper issues, but didnt' notice a bus for certs.
Since this affects well know sites it would seems to be quite an important issue?
Changed in openssl: | |
status: | Unknown → Confirmed |
description: | updated |
description: | updated |
Changed in openssl (Ubuntu): | |
status: | Confirmed → Invalid |
description: | updated |
I found a fix: Class_3_ Public_ Primary_ Certification_ Authority. crt from a lucid/10.04 system (in /usr/share/ ca-certificates /mozilla)
copy Verisign_
Sounds a bit whacky, but invalid certs have been delivered with 12.04?
I did a diff, the changes between 10.04 and 12.04 in that directory for verisign are: Class_3_ Public_ Primary_ Certification_ Authority_ -_G4.crt Universal_ Root_Certificat ion_Authority. crt
New:
VeriSign_
VeriSign_
Changed: Class_1_ Public_ Primary_ Certification_ Authority. crt Class_3_ Public_ Primary_ Certification_ Authority. crt
Verisign_
Verisign_