{{ message }}
Repository navigation
Certificates trusted by Mozilla fail the check #16
Description
Sites with certificates trusted by the latest Mozilla Firefox are being reported as not trusted.
More specifically, I have observed such behavior from VeriSign Class 3 Public Primary Certification Authority - G5 and AddTrust Public Services Root so far. Will update this bug if I find more root CAs included in the moz-certs.pem and reported as not trusted.
Activity
benjaminp commentedon Jan 19, 2015
See if
curlfails, too. Browsers tend to be more aggressive building trust chains when there are missing intermediate certs than openssl.daknob commentedon Jan 19, 2015
Nope,
curl(1)does not fail on getting the site overhttps.daknob commentedon Jan 19, 2015
To make a clarification, I visit the aforementioned websites with Firefox and there is no error but the script reports an error in the certificate and that it's not trusted by Firefox.
daknob commentedon Jan 19, 2015
Update: Two websites that make sure of the same Root CA are being reported one as trusted and the other as not trusted. The site reported as not trusted has an EV Certificate if that helps.
benjaminp commentedon Jan 19, 2015
What are the sites?
daknob commentedon Jan 19, 2015
https://www.nbg.gr/
https://www.alpha.gr/
benjaminp commentedon Jan 19, 2015
I think we're hitting the recent removal of 1024-bit certs from the Mozilla cert bundle and the fact that OpenSSL doesn't support certificate path discovery. Does it work with my recent change to
moz-certs.pem?daknob commentedon Jan 19, 2015
Some sites (mostly EV's) have been fixed. Others unfortunately continue to be reported as not trusted.. I am still looking for a better file / solution to this problem as we speak..
daknob commentedon Jan 19, 2015
I have manually added the Root CA's again into the
moz-certs.pemfile and it still cannot mark the websites as trusted. Checked the signature of the certificate presented and the certificate added in the file and they are identical.. Problem with OpenSSL? Something else?benjaminp commentedon Jan 19, 2015
I think I fixed https://www.nbg.gr/ hanging.
benjaminp commentedon Jan 19, 2015
Both www.nbg.gr and www.alpha.gr work for me now.
daknob commentedon Jan 19, 2015
Yup, they seem to work fine.
The problem now is that the script gets
EPERM( Issue #27 ) instead of anything else to show a better error message.benjaminp commentedon Jan 19, 2015
So, is this issue resolved?
benjaminp commentedon Jan 19, 2015
What domains are still failing?
daknob commentedon Jan 19, 2015
An example is https://www.auth.gr
benjaminp commentedon Jan 19, 2015
Evidently that's a recently fixed limitation of OpenSSL.