Last active
October 2, 2015 15:28
-
-
Save divergentdave/90d77c7b4d2a4b3b9a32 to your computer and use it in GitHub Desktop.
SBA TLS cert chain issues
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # s:/C=US/O=Symantec Corporation/OU=Symantec Trust Network/CN=Symantec Class 3 Secure Server CA - G4 | |
| # i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5 | |
| -----BEGIN CERTIFICATE----- | |
| MIIFODCCBCCgAwIBAgIQUT+5dDhwtzRAQY0wkwaZ/zANBgkqhkiG9w0BAQsFADCB | |
| yjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL | |
| ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJp | |
| U2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxW | |
| ZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0 | |
| aG9yaXR5IC0gRzUwHhcNMTMxMDMxMDAwMDAwWhcNMjMxMDMwMjM1OTU5WjB+MQsw | |
| CQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNV | |
| BAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxLzAtBgNVBAMTJlN5bWFudGVjIENs | |
| YXNzIDMgU2VjdXJlIFNlcnZlciBDQSAtIEc0MIIBIjANBgkqhkiG9w0BAQEFAAOC | |
| AQ8AMIIBCgKCAQEAstgFyhx0LbUXVjnFSlIJluhL2AzxaJ+aQihiw6UwU35VEYJb | |
| A3oNL+F5BMm0lncZgQGUWfm893qZJ4Itt4PdWid/sgN6nFMl6UgfRk/InSn4vnlW | |
| 9vf92Tpo2otLgjNBEsPIPMzWlnqEIRoiBAMnF4scaGGTDw5RgDMdtLXO637QYqzu | |
| s3sBdO9pNevK1T2p7peYyo2qRA4lmUoVlqTObQJUHypqJuIGOmNIrLRM0XWTUP8T | |
| L9ba4cYY9Z/JJV3zADreJk20KQnNDz0jbxZKgRb78oMQw7jW2FUyPfG9D72MUpVK | |
| Fpd6UiFjdS8W+cRmvvW1Cdj/JwDNRHxvSz+w9wIDAQABo4IBYzCCAV8wEgYDVR0T | |
| AQH/BAgwBgEB/wIBADAwBgNVHR8EKTAnMCWgI6Ahhh9odHRwOi8vczEuc3ltY2Iu | |
| Y29tL3BjYTMtZzUuY3JsMA4GA1UdDwEB/wQEAwIBBjAvBggrBgEFBQcBAQQjMCEw | |
| HwYIKwYBBQUHMAGGE2h0dHA6Ly9zMi5zeW1jYi5jb20wawYDVR0gBGQwYjBgBgpg | |
| hkgBhvhFAQc2MFIwJgYIKwYBBQUHAgEWGmh0dHA6Ly93d3cuc3ltYXV0aC5jb20v | |
| Y3BzMCgGCCsGAQUFBwICMBwaGmh0dHA6Ly93d3cuc3ltYXV0aC5jb20vcnBhMCkG | |
| A1UdEQQiMCCkHjAcMRowGAYDVQQDExFTeW1hbnRlY1BLSS0xLTUzNDAdBgNVHQ4E | |
| FgQUX2DPYZBV34RDFIpgKrL1evRDGO8wHwYDVR0jBBgwFoAUf9Nlp8Ld7LvwMAnz | |
| Qzn6Aq8zMTMwDQYJKoZIhvcNAQELBQADggEBAF6UVkndji1l9cE2UbYD49qecxny | |
| H1mrWH5sJgUs+oHXXCMXIiw3k/eG7IXmsKP9H+IyqEVv4dn7ua/ScKAyQmW/hP4W | |
| Ko8/xabWo5N9Q+l0IZE1KPRj6S7t9/Vcf0uatSDpCr3gRRAMFJSaXaXjS5HoJJtG | |
| QGX0InLNmfiIEfXzf+YzguaoxX7+0AjiJVgIcWjmzaLmFN5OUiQt/eV5E1PnXi8t | |
| TRttQBVSK/eHiXgSgW7ZTaoteNTCLD0IX4eRnh8OsN4wUmSGiaqdZpwOdgyA8nTY | |
| Kvi4Os7X1g8RvmurFPW9QaAiY4nxug9vKWNmLT+sjHLF+8fk1A/yO0+MKcc= | |
| -----END CERTIFICATE----- | |
| # s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5 | |
| # i:/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority | |
| -----BEGIN CERTIFICATE----- | |
| MIIE0DCCBDmgAwIBAgIQJQzo4DBhLp8rifcFTXz4/TANBgkqhkiG9w0BAQUFADBf | |
| MQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsT | |
| LkNsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkw | |
| HhcNMDYxMTA4MDAwMDAwWhcNMjExMTA3MjM1OTU5WjCByjELMAkGA1UEBhMCVVMx | |
| FzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVz | |
| dCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2lnbiwgSW5jLiAtIEZv | |
| ciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAz | |
| IFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzUwggEi | |
| MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvJAgIKXo1nmAMqudLO07cfLw8 | |
| RRy7K+D+KQL5VwijZIUVJ/XxrcgxiV0i6CqqpkKzj/i5Vbext0uz/o9+B1fs70Pb | |
| ZmIVYc9gDaTY3vjgw2IIPVQT60nKWVSFJuUrjxuf6/WhkcIzSdhDY2pSS9KP6HBR | |
| TdGJaXvHcPaz3BJ023tdS1bTlr8Vd6Gw9KIl8q8ckmcY5fQGBO+QueQA5N06tRn/ | |
| Arr0PO7gi+s3i+z016zy9vA9r911kTMZHRxAy3QkGSGT2RT+rCpSx4/VBEnkjWNH | |
| iDxpg8v+R70rfk/Fla4OndTRQ8Bnc+MUCH7lP59zuDMKz10/NIeWiu5T6CUVAgMB | |
| AAGjggGbMIIBlzAPBgNVHRMBAf8EBTADAQH/MDEGA1UdHwQqMCgwJqAkoCKGIGh0 | |
| dHA6Ly9jcmwudmVyaXNpZ24uY29tL3BjYTMuY3JsMA4GA1UdDwEB/wQEAwIBBjA9 | |
| BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVy | |
| aXNpZ24uY29tL2NwczAdBgNVHQ4EFgQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMwbQYI | |
| KwYBBQUHAQwEYTBfoV2gWzBZMFcwVRYJaW1hZ2UvZ2lmMCEwHzAHBgUrDgMCGgQU | |
| j+XTGoasjY5rw8+AatRIGCx7GS4wJRYjaHR0cDovL2xvZ28udmVyaXNpZ24uY29t | |
| L3ZzbG9nby5naWYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8v | |
| b2NzcC52ZXJpc2lnbi5jb20wPgYDVR0lBDcwNQYIKwYBBQUHAwEGCCsGAQUFBwMC | |
| BggrBgEFBQcDAwYJYIZIAYb4QgQBBgpghkgBhvhFAQgBMA0GCSqGSIb3DQEBBQUA | |
| A4GBABMC3fjohgDyWvj4IAxZiGIHzs73Tvm7WaGY5eE43U68ZhjTresY8g3JbT5K | |
| lCDDPLq9ZVTGr0SzEK0saz6r1we2uIFjxfleLuUqZ87NMwwq14lWAyMfs77oOghZ | |
| tOxFNfeKW/9mz1Cvxm1XjRl4t7mi0VfqH5pLr7rJjhJ+xr3/ | |
| -----END CERTIFICATE----- |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/sh | |
| exec 2>&1 | |
| openssl version | |
| # The following two commands both work, with just one CA cert, each building | |
| # a different path | |
| echo "TESTING: Verisign CA" | |
| SSL_CERT_FILE=/dev/null SSL_CERT_DIR=/dev/null echo | openssl s_client -connect www.sba.gov:443 -servername www.sba.gov -CAfile verisign_class_3_public_primary_certification_authority.pem -tls1 | |
| echo "TESTING: Verisign G5 CA" | |
| SSL_CERT_FILE=/dev/null SSL_CERT_DIR=/dev/null echo | openssl s_client -connect www.sba.gov:443 -servername www.sba.gov -CAfile verisign_class_3_public_primary_certification_authority_g5.pem -tls1 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/sh | |
| set -v | |
| openssl verify -untrusted chain.pem -CAfile verisign_class_3_public_primary_certification_authority_g5.pem server.pem | |
| openssl verify -untrusted chain.pem -CAfile verisign_class_3_public_primary_certification_authority.pem server.pem |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/env python3 | |
| import ssl | |
| import socket | |
| URL = "https://www.sba.gov" | |
| HOST = "www.sba.gov" | |
| PORT = 443 | |
| def ssltest(): | |
| print(ssl.OPENSSL_VERSION) | |
| for cas in [ | |
| "verisign_class_3_public_primary_certification_authority.pem", | |
| "verisign_class_3_public_primary_certification_authority_g5.pem", | |
| ]: | |
| print(cas) | |
| ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1) | |
| ctx.load_verify_locations(cafile=cas) | |
| ctx.verify_mode = ssl.CERT_REQUIRED | |
| ctx.verify_flags = ssl.VERIFY_DEFAULT | |
| ctx.check_hostname = True | |
| s = socket.socket() | |
| try: | |
| s.connect((HOST, PORT)) | |
| w = ctx.wrap_socket(s, server_hostname=HOST) | |
| w.close() | |
| except ssl.SSLError as e: | |
| print("Caught %s" % e) | |
| print("library: %s\nreason: %s" % (e.library, e.reason)) | |
| finally: | |
| s.close() | |
| # Verifying against verisign_class_3_public_primary_certificatoin_authority.pem | |
| # is sufficient to verify the server, and yet the ..._g5.pem certificate doesn't | |
| # suffice. | |
| # Browser and SSLtest use the same ..._g5 certificate that we have here | |
| ssltest() |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import ssl | |
| import socket | |
| HOST = "www.sba.gov" | |
| PORT = 443 | |
| CA = """ | |
| # Issuer: CN=VeriSign Class 3 Public Primary Certification Authority - G5 O=VeriSign, Inc. OU=VeriSign Trust Network/(c) 2006 VeriSign, Inc. - For authorized use only | |
| # Subject: CN=VeriSign Class 3 Public Primary Certification Authority - G5 O=VeriSign, Inc. OU=VeriSign Trust Network/(c) 2006 VeriSign, Inc. - For authorized use only | |
| # Label: "VeriSign Class 3 Public Primary Certification Authority - G5" | |
| # Serial: 33037644167568058970164719475676101450 | |
| # MD5 Fingerprint: cb:17:e4:31:67:3e:e2:09:fe:45:57:93:f3:0a:fa:1c | |
| # SHA1 Fingerprint: 4e:b6:d5:78:49:9b:1c:cf:5f:58:1e:ad:56:be:3d:9b:67:44:a5:e5 | |
| # SHA256 Fingerprint: 9a:cf:ab:7e:43:c8:d8:80:d0:6b:26:2a:94:de:ee:e4:b4:65:99:89:c3:d0:ca:f1:9b:af:64:05:e4:1a:b7:df | |
| -----BEGIN CERTIFICATE----- | |
| MIIE0zCCA7ugAwIBAgIQGNrRniZ96LtKIVjNzGs7SjANBgkqhkiG9w0BAQUFADCB | |
| yjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL | |
| ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJp | |
| U2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxW | |
| ZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0 | |
| aG9yaXR5IC0gRzUwHhcNMDYxMTA4MDAwMDAwWhcNMzYwNzE2MjM1OTU5WjCByjEL | |
| MAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZW | |
| ZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2ln | |
| biwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJp | |
| U2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9y | |
| aXR5IC0gRzUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvJAgIKXo1 | |
| nmAMqudLO07cfLw8RRy7K+D+KQL5VwijZIUVJ/XxrcgxiV0i6CqqpkKzj/i5Vbex | |
| t0uz/o9+B1fs70PbZmIVYc9gDaTY3vjgw2IIPVQT60nKWVSFJuUrjxuf6/WhkcIz | |
| SdhDY2pSS9KP6HBRTdGJaXvHcPaz3BJ023tdS1bTlr8Vd6Gw9KIl8q8ckmcY5fQG | |
| BO+QueQA5N06tRn/Arr0PO7gi+s3i+z016zy9vA9r911kTMZHRxAy3QkGSGT2RT+ | |
| rCpSx4/VBEnkjWNHiDxpg8v+R70rfk/Fla4OndTRQ8Bnc+MUCH7lP59zuDMKz10/ | |
| NIeWiu5T6CUVAgMBAAGjgbIwga8wDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8E | |
| BAMCAQYwbQYIKwYBBQUHAQwEYTBfoV2gWzBZMFcwVRYJaW1hZ2UvZ2lmMCEwHzAH | |
| BgUrDgMCGgQUj+XTGoasjY5rw8+AatRIGCx7GS4wJRYjaHR0cDovL2xvZ28udmVy | |
| aXNpZ24uY29tL3ZzbG9nby5naWYwHQYDVR0OBBYEFH/TZafC3ey78DAJ80M5+gKv | |
| MzEzMA0GCSqGSIb3DQEBBQUAA4IBAQCTJEowX2LP2BqYLz3q3JktvXf2pXkiOOzE | |
| p6B4Eq1iDkVwZMXnl2YtmAl+X6/WzChl8gGqCBpH3vn5fJJaCGkgDdk+bW48DW7Y | |
| 5gaRQBi5+MHt39tBquCWIMnNZBU4gcmU7qKEKQsTb47bDN0lAtukixlE0kF6BWlK | |
| WE9gyn6CagsCqiUXObXbf+eEZSqVir2G3l6BFoMtEMze/aiCKm0oHw0LxOXnGiYZ | |
| 4fQRbxC1lfznQgUy286dUV4otp6F01vvpX1FQHKOtw5rDgb7MzVIcbidJ4vEZV8N | |
| hnacRHr2lVz2XTIIM6RUthg/aFzyQkqFOFSDX9HoLPKsEdao7WNq | |
| -----END CERTIFICATE----- | |
| """ | |
| def ssltest(): | |
| ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1) | |
| ctx.load_verify_locations(cadata=CA) | |
| ctx.verify_mode = ssl.CERT_REQUIRED | |
| ctx.verify_flags = ssl.VERIFY_DEFAULT | |
| ctx.check_hostname = True | |
| s = socket.socket() | |
| try: | |
| s.connect((HOST, PORT)) | |
| w = ctx.wrap_socket(s, server_hostname=HOST) | |
| w.close() | |
| except ssl.SSLError as e: | |
| print("Caught %s" % e) | |
| print("library: %s\nreason: %s" % (e.library, e.reason)) | |
| finally: | |
| s.close() | |
| ssltest() |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| -----BEGIN CERTIFICATE----- | |
| MIIE9jCCA96gAwIBAgIQH6SqyzoHuju2yJAiEroDoDANBgkqhkiG9w0BAQsFADB+ | |
| MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAd | |
| BgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxLzAtBgNVBAMTJlN5bWFudGVj | |
| IENsYXNzIDMgU2VjdXJlIFNlcnZlciBDQSAtIEc0MB4XDTE0MTExMjAwMDAwMFoX | |
| DTE4MTExMjIzNTk1OVowgYcxCzAJBgNVBAYTAlVTMR0wGwYDVQQIDBREaXN0cmlj | |
| dCBvZiBDb2x1bWJpYTEWMBQGA1UEBwwNV2FzaGluZ3RvbiBEQzErMCkGA1UECgwi | |
| VS5TLiBTbWFsbCBCdXNpbmVzcyBBZG1pbmlzdHJhdGlvbjEUMBIGA1UEAwwLd3d3 | |
| LnNiYS5nb3YwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCjgKYdZmKa | |
| +PodR3E7LplvofNsKWgtvmi9kcvzf2hWmZ3rtPuWRUGvI9XHQjl8w3hRGFpOHs5R | |
| P9J6E9j8VT/zKFoG+mJqj5kdFdCkVrvWW8tkpnd0vYgQag6+CXGk2XIFxBvLGSms | |
| 0MWdNXcFbMRwsx5Ox0c9Sgt2Z6VrFe9pygKGf2WoAF5DYDbSqCODDZH0i5o1xzIU | |
| qHq3Ozw6+Jbch60kksOH1WaGRKFOqu5m8CLIZhPbaILUw88EXRBLwBoWHtR3bQub | |
| 9l6S8iGfD52aEmlqX4L7ssgi98S10Ks5cK8R7xSO8W1GdqFpgGvLyWmIY0Uizjdo | |
| TA2h64Vtpn0FAgMBAAGjggFkMIIBYDAWBgNVHREEDzANggt3d3cuc2JhLmdvdjAJ | |
| BgNVHRMEAjAAMA4GA1UdDwEB/wQEAwIFoDArBgNVHR8EJDAiMCCgHqAchhpodHRw | |
| Oi8vc3Muc3ltY2IuY29tL3NzLmNybDBlBgNVHSAEXjBcMFoGCmCGSAGG+EUBBzYw | |
| TDAjBggrBgEFBQcCARYXaHR0cHM6Ly9kLnN5bWNiLmNvbS9jcHMwJQYIKwYBBQUH | |
| AgIwGQwXaHR0cHM6Ly9kLnN5bWNiLmNvbS9ycGEwHQYDVR0lBBYwFAYIKwYBBQUH | |
| AwEGCCsGAQUFBwMCMB8GA1UdIwQYMBaAFF9gz2GQVd+EQxSKYCqy9Xr0QxjvMFcG | |
| CCsGAQUFBwEBBEswSTAfBggrBgEFBQcwAYYTaHR0cDovL3NzLnN5bWNkLmNvbTAm | |
| BggrBgEFBQcwAoYaaHR0cDovL3NzLnN5bWNiLmNvbS9zcy5jcnQwDQYJKoZIhvcN | |
| AQELBQADggEBAIeyBl4XnXBYNM+HqxZ4lyH2ZK//OJlHp5HFH8BiWstDUWE8cOzG | |
| l1s9RGS7yQRQl7+/mPwPji3OPcbq/b2bGjmRlHI5SIQMLroRam1mry4gRizRl4Kc | |
| xdnubzcpdeyyUea09VowGxVQfVvvNdcv8FK4kz+yrbZj/iFTupiwb7WyaJZTwFAy | |
| gRihDaHxAKD7Enl+NtmRe1OHbX1fKbiNe8kgXldqJ2YV39TCTSnE4gU8QwcIbtjZ | |
| RIIKH4Z7/cFSL9DiXLkwBasDy3zFNtuo1jMsRDIF03T7FmhqS2vTuBVD5YybC9uE | |
| ruUqNR2ukV4nEUzdIYv1FEdWxFmwEnDI8Ac= | |
| -----END CERTIFICATE----- |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment