ubuntu - Can't verify CA certificate unless CApath or CAfile used -


im having trouble having openssl connect server because of trust issues. placed ca certificate on /etc/ssl/certs/ , have run sudo c_rehash , can see correct file has been made. can see ca certificate in ca-certificates.crt. if run:

openssl s_client -connect servername.domain.com:636

the command fails verify return code: 21 (unable verify first certificate)

if do:

openssl s_client -connect servername.domain.com:636 -capath /etc/ssl/certs/

i verify return code: 0 (ok)

what can dont have specify capath?

i'm using ubuntu 13.04.

openssl connect server because of trust issues.

unlike browsers, trust anybody, openssl trusts nothing default.

its determine should trusted. have specify when using openssl , s_client.

if working programmatically openssl api, have more options. appears related using openssl commands.

what can don't have specify capath?

you can use cafile. avoids rehash, , creates 1:1 mapping trust of domain. is, trust 1 issuer domain in question. if other issuer claims issuer, won't trust issuer or server.

you can see how extract needed info openssl's s_client , use cafile @ how grab ssl certificate in openssl.

when using certificates present in capath, trust issuer, if not real issuer. has happened in past , bad.

the corner case bad guy compromises ca trust , issues phony certifcates domain. has happened in past too, , bad.

in 2 negative cases above, can forgo conferring trust dns , cas , use security diversification technique certificate or public key pinning. if there's pre-existing relationship between , site, know expected public key of server. in case, there's no need trust ca.


Comments

Post a Comment

Popular posts from this blog

Android layout hidden on keyboard show -

i have strange problem layout. when tap on edittext , keyboard shown edittext stay on bottom , when tap on to hide keyboard , keyboard hides , edittext go should when want input text. when tap again, keyboard shown , edittext goes down behind keyboard... <relativelayout android:layout_width="match_parent" android:layout_height="match_parent" > <scrollview android:layout_width="match_parent" android:layout_height="fill_parent" android:above="@+id/rl_commands"> <textview android:layout_width="match_parent" android:layout_height="wrap_content"/> </scrollview> <relativelayout android:layout_width="match_parent android:layout_height="24dp" android:id="@+id/rl_commands" android:alignparentbottom="true">
Read more

google app engine - 403 Forbidden POST - Flask WTForms -

i have flask application running on google app engine. trying submit form built using wtform , keep getting following error. 403 forbidden: don't have permission access requested resource. either read-protected or not readable server. location.html (part of code) <form method=post action="/home/location"> .... <button type="submit" class="btn btn-primary" value="submit"> directions </button> </form> main.py @app.route('/home/location', methods=['post', 'get']) def location(): form = cfcdirections.direction(request.form) print(request.method) if request.method == 'post' , form.validate(): print("after if") directions = cfcdirections() street_no = directions.no street = directions.street suburb = directions.suburb postcode = directions.postcode
Read more

c - Why would PK11_GenerateRandom() return an error -8023? -

i looking through internet trying find source of pk11_generaterandom() function see why function fail. have program uses function when moved new flavor of linux, fails after forking ( fork() ) since not believe there problem nss, suspect doing incorrectly disregarded in older versions of linux new 1 there issue. the openssl package same on 'good' , 'bad' server: openssl 0.9.8e-fips-rhel5 01 jul nss rpm differs though. 'good' has nss-3.12.2.0-2.el5 and bas has version nss-3.15.3-4.el5_10 the 'good' server uses quite obsolete linux: linux 2.6.18-128.el5 #1 smp wed jan 21 08:45:05 est 2009 x86_64 x86_64 x86_64 gnu/linux enterprise linux enterprise linux server release 5.3 (carthage) red hat enterprise linux server release 5.3 (tikanga) the 'bad' server newer: linux bad 2.6.18-371.4.1.el5 #1 smp wed jan 29 11:05:49 pst 2014 x86_64 x86_64 x86_64 gnu/linux oracle linux server release 5.10 red hat enterprise linux server release
Read more