After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 699026 - Build certificate chains out of incorrectly ordered certificates
Build certificate chains out of incorrectly ordered certificates
Status: RESOLVED FIXED
Product: gcr
Classification: Core
Component: General
unspecified
Other Linux
: Normal normal
: ---
Assigned To: GNOME keyring maintainer(s)
GNOME keyring maintainer(s)
Depends on:
Blocks:
 
 
Reported: 2013-04-27 11:26 UTC by Stef Walter
Modified: 2019-02-22 11:58 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
Build certificate chains even when intermediates are wrong order (15.99 KB, patch)
2013-04-27 11:28 UTC, Stef Walter 		committed Details | Review

Description Stef Walter 2013-04-27 11:26:50 UTC 
In GcrCertificateChain we respect the RFC 5246 which requires that certificates appear in the correct order from the server: First the endpoint, then intermediates, and (optionally the root last).

However some servers (like hermes.jabber.org) send certificates in an incorrect order. It seems like many SSL implementations accept intermediate certificates out of order.
Comment 1 Stef Walter 2013-04-27 11:28:23 UTC 
Created attachment 242651 [details] [review]
Build certificate chains even when intermediates are wrong order

In GcrCertificateChain we respect the RFC 5246 which requires
that certificates appear in the correct order from the server:
First the endpoint, then intermediates, and (optionally the
root last).

However some servers (like hermes.jabber.org) send certificates
in an incorrect order. It seems like many SSL implementations
accept intermediate certificates out of order.
Comment 2 Stef Walter 2013-04-27 11:28:45 UTC 
http://tools.ietf.org/html/rfc5246#section-7.4.2
Comment 3 Stef Walter 2013-04-27 11:29:35 UTC 
Bug report in Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=956701
Comment 4 Stef Walter 2013-04-27 11:43:25 UTC 
OpenSSL accepts out of order certificates. Can be verified by doing:

$ openssl s_client -connect hermes.jabber.org:5223

Or see:

http://repo.or.cz/w/mirror-openssl.git/blob/HEAD:/crypto/x509/x509_vfy.c#l237
Comment 5 Stef Walter 2013-05-03 20:04:50 UTC 
Attachment 242651 [details] pushed as 5cadd24 - Build certificate chains even when intermediates are wrong order