{"action":"created","issue":{"url":"https://api.github.com/repos/libressl-portable/portable/issues/80","repository_url":"https://api.github.com/repos/libressl-portable/portable","labels_url":"https://api.github.com/repos/libressl-portable/portable/issues/80/labels{/name}","comments_url":"https://api.github.com/repos/libressl-portable/portable/issues/80/comments","events_url":"https://api.github.com/repos/libressl-portable/portable/issues/80/events","html_url":"https://github.com/libressl-portable/portable/issues/80","id":69308805,"number":80,"title":"LibreSSL fails to verify alternate chains. ","user":{"login":"DomT4","id":6998367,"avatar_url":"https://avatars.githubusercontent.com/u/6998367?v=3","gravatar_id":"","url":"https://api.github.com/users/DomT4","html_url":"https://github.com/DomT4","followers_url":"https://api.github.com/users/DomT4/followers","following_url":"https://api.github.com/users/DomT4/following{/other_user}","gists_url":"https://api.github.com/users/DomT4/gists{/gist_id}","starred_url":"https://api.github.com/users/DomT4/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DomT4/subscriptions","organizations_url":"https://api.github.com/users/DomT4/orgs","repos_url":"https://api.github.com/users/DomT4/repos","events_url":"https://api.github.com/users/DomT4/events{/privacy}","received_events_url":"https://api.github.com/users/DomT4/received_events","type":"User","site_admin":false},"labels":[{"id":113267300,"url":"https://api.github.com/repos/libressl-portable/portable/labels/bug","name":"bug","color":"fc2929","default":true}],"state":"closed","locked":false,"assignee":{"login":"bob-beck","id":8124021,"avatar_url":"https://avatars.githubusercontent.com/u/8124021?v=3","gravatar_id":"","url":"https://api.github.com/users/bob-beck","html_url":"https://github.com/bob-beck","followers_url":"https://api.github.com/users/bob-beck/followers","following_url":"https://api.github.com/users/bob-beck/following{/other_user}","gists_url":"https://api.github.com/users/bob-beck/gists{/gist_id}","starred_url":"https://api.github.com/users/bob-beck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bob-beck/subscriptions","organizations_url":"https://api.github.com/users/bob-beck/orgs","repos_url":"https://api.github.com/users/bob-beck/repos","events_url":"https://api.github.com/users/bob-beck/events{/privacy}","received_events_url":"https://api.github.com/users/bob-beck/received_events","type":"User","site_admin":false},"assignees":[{"login":"bob-beck","id":8124021,"avatar_url":"https://avatars.githubusercontent.com/u/8124021?v=3","gravatar_id":"","url":"https://api.github.com/users/bob-beck","html_url":"https://github.com/bob-beck","followers_url":"https://api.github.com/users/bob-beck/followers","following_url":"https://api.github.com/users/bob-beck/following{/other_user}","gists_url":"https://api.github.com/users/bob-beck/gists{/gist_id}","starred_url":"https://api.github.com/users/bob-beck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bob-beck/subscriptions","organizations_url":"https://api.github.com/users/bob-beck/orgs","repos_url":"https://api.github.com/users/bob-beck/repos","events_url":"https://api.github.com/users/bob-beck/events{/privacy}","received_events_url":"https://api.github.com/users/bob-beck/received_events","type":"User","site_admin":false}],"milestone":null,"comments":6,"created_at":"2015-04-18T13:23:13Z","updated_at":"2016-11-06T10:42:33Z","closed_at":"2016-11-06T10:42:32Z","body":"OS X 10.10.3’s release changed some certs in the Keychain. There’s a full list of changes here: https://gist.github.com/DomT4/f86618bdfe2f27c8d66a\n\nThis has caused some chaos with OpenSSL and LibreSSL, in things built against them, using a .pem generated from OS X’s Keychains. The biggest, most popular affected sites are the whole range of Google domains.\n\nGoogle cross-sign their GeoTrust root with an old Equifax root (Equifax Secure Certificate Authority) because a lot of the older clients don’t have the GeoTrust root on their system and would just error out. Have emailed with Adam Langley on the cert errors and essentially Google aren’t going to be able to stop that cross-signing any time soon.\n\nAccording to Adam most SSL clients should go through the cert chain of the domain and hit the GeoTrust cert and verify at that point, if the GeoTrust root exists in a .pem file LibreSSL can find and use, which does exist when generating a PEM from the system Keychains. It’s not supposed to carry on to the Equifax root, but it is, and this is causing breakage on OS X 10.10.3 onwards.\n\nThis problem only exists in OpenSSL and LibreSSL as far as testing goes. It isn’t reproducible with Apple’s Security Framework, or GnuTLS.\n\nInterestingly, Apple have done something to their shipped OpenSSL 0.9.8x to fix the problem - If I build OpenSSL 0.9.8x from source and use it, failure, but if I use the one Apple installs the connection verifies and succeeds. Here’s hoping they’ve punted whatever those changes were upstream to OpenSSL or OpenBSD (For LibreSSL).\n\nThis is the error you get:\n\n```\n—2015-04-10 16:58:58—  https://google.com/\nResolving google.com… 216.58.210.46, 2a00:1450:4009:800::200e\nConnecting to google.com|216.58.210.46|:443… connected.\nERROR: cannot verify google.com’s certificate, issued by ‘CN=Google\nInternet Authority G2,O=Google Inc,C=US’:\n  Unable to locally verify the issuer’s authority.\nTo connect to google.com insecurely, use `—no-check-certificate’.\n```\n\nHow to reproduce:\n- Install LibreSSL on OS X 10.10.3 or above. I have it installed to /usr/local/opt/libressl - With the sysconfdir in /usr/local/etc.\n- Generate a PEM file from OS X’s Security Keychain:\n  - security find-certificate -a -p /Library/Keychains/System.keychain >> sys.pem\n  - security find-certificate -a -p /System/Library/Keychains/SystemRootCertificates.keychain >> sysroot.pem\n  - cat sys.pem >> sysroot.pem\n  - mv sysroot.pem /usr/local/etc/libressl\n- Download and install cURL:\n  - Pass “—with-ssl=/path/to/libressl/dir” and “--with-ca-bundle=/path/to/sysconfdir/libressl/sysroot.pem” to configure.\n- Run “/path/to/your/installed/curl -I https://google.com”\n\nIt reproduces with wget, mutt, various other tools. If you put the Equifax certificate back, and then certhash, you can make the connection. But the Equifax cert is old, and weak, and Apple aren’t likely to return it to the Keychain. So this problem connecting to Google will persist until the reason for not stopping at and verifying on the GeoTrust root are narrowed down and hopefully fixed.\n\nMozilla are also pressing ahead with removing that Equifax root from their certs, so it’s not a simple case of working around it by switching PEM.\n"},"comment":{"url":"https://api.github.com/repos/libressl-portable/portable/issues/comments/258672775","html_url":"https://github.com/libressl-portable/portable/issues/80#issuecomment-258672775","issue_url":"https://api.github.com/repos/libressl-portable/portable/issues/80","id":258672775,"user":{"login":"bob-beck","id":8124021,"avatar_url":"https://avatars.githubusercontent.com/u/8124021?v=3","gravatar_id":"","url":"https://api.github.com/users/bob-beck","html_url":"https://github.com/bob-beck","followers_url":"https://api.github.com/users/bob-beck/followers","following_url":"https://api.github.com/users/bob-beck/following{/other_user}","gists_url":"https://api.github.com/users/bob-beck/gists{/gist_id}","starred_url":"https://api.github.com/users/bob-beck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bob-beck/subscriptions","organizations_url":"https://api.github.com/users/bob-beck/orgs","repos_url":"https://api.github.com/users/bob-beck/repos","events_url":"https://api.github.com/users/bob-beck/events{/privacy}","received_events_url":"https://api.github.com/users/bob-beck/received_events","type":"User","site_admin":false},"created_at":"2016-11-06T10:42:32Z","updated_at":"2016-11-06T10:42:32Z","body":"Fix committed. It will appear in the next portable release. "}}
{"actor":{"display_login":"bob-beck"}}