{"action":"created","issue":{"url":"https://api.github.com/repos/postmanlabs/postman-app-support/issues/4627","repository_url":"https://api.github.com/repos/postmanlabs/postman-app-support","labels_url":"https://api.github.com/repos/postmanlabs/postman-app-support/issues/4627/labels{/name}","comments_url":"https://api.github.com/repos/postmanlabs/postman-app-support/issues/4627/comments","events_url":"https://api.github.com/repos/postmanlabs/postman-app-support/issues/4627/events","html_url":"https://github.com/postmanlabs/postman-app-support/issues/4627","id":328125675,"node_id":"MDU6SXNzdWUzMjgxMjU2NzU=","number":4627,"title":"Client certificate issue with certificate signed by an intermediary CA","user":{"login":"EasyMilos","id":39622995,"node_id":"MDQ6VXNlcjM5NjIyOTk1","avatar_url":"https://avatars2.githubusercontent.com/u/39622995?v=4","gravatar_id":"","url":"https://api.github.com/users/EasyMilos","html_url":"https://github.com/EasyMilos","followers_url":"https://api.github.com/users/EasyMilos/followers","following_url":"https://api.github.com/users/EasyMilos/following{/other_user}","gists_url":"https://api.github.com/users/EasyMilos/gists{/gist_id}","starred_url":"https://api.github.com/users/EasyMilos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/EasyMilos/subscriptions","organizations_url":"https://api.github.com/users/EasyMilos/orgs","repos_url":"https://api.github.com/users/EasyMilos/repos","events_url":"https://api.github.com/users/EasyMilos/events{/privacy}","received_events_url":"https://api.github.com/users/EasyMilos/received_events","type":"User","site_admin":false},"labels":[{"id":212512,"node_id":"MDU6TGFiZWwyMTI1MTI=","url":"https://api.github.com/repos/postmanlabs/postman-app-support/labels/Bug","name":"Bug","color":"e10c02","default":false}],"state":"closed","locked":false,"assignee":{"login":"a85","id":653409,"node_id":"MDQ6VXNlcjY1MzQwOQ==","avatar_url":"https://avatars2.githubusercontent.com/u/653409?v=4","gravatar_id":"","url":"https://api.github.com/users/a85","html_url":"https://github.com/a85","followers_url":"https://api.github.com/users/a85/followers","following_url":"https://api.github.com/users/a85/following{/other_user}","gists_url":"https://api.github.com/users/a85/gists{/gist_id}","starred_url":"https://api.github.com/users/a85/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/a85/subscriptions","organizations_url":"https://api.github.com/users/a85/orgs","repos_url":"https://api.github.com/users/a85/repos","events_url":"https://api.github.com/users/a85/events{/privacy}","received_events_url":"https://api.github.com/users/a85/received_events","type":"User","site_admin":false},"assignees":[{"login":"a85","id":653409,"node_id":"MDQ6VXNlcjY1MzQwOQ==","avatar_url":"https://avatars2.githubusercontent.com/u/653409?v=4","gravatar_id":"","url":"https://api.github.com/users/a85","html_url":"https://github.com/a85","followers_url":"https://api.github.com/users/a85/followers","following_url":"https://api.github.com/users/a85/following{/other_user}","gists_url":"https://api.github.com/users/a85/gists{/gist_id}","starred_url":"https://api.github.com/users/a85/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/a85/subscriptions","organizations_url":"https://api.github.com/users/a85/orgs","repos_url":"https://api.github.com/users/a85/repos","events_url":"https://api.github.com/users/a85/events{/privacy}","received_events_url":"https://api.github.com/users/a85/received_events","type":"User","site_admin":false},{"login":"harryi3t","id":5207331,"node_id":"MDQ6VXNlcjUyMDczMzE=","avatar_url":"https://avatars2.githubusercontent.com/u/5207331?v=4","gravatar_id":"","url":"https://api.github.com/users/harryi3t","html_url":"https://github.com/harryi3t","followers_url":"https://api.github.com/users/harryi3t/followers","following_url":"https://api.github.com/users/harryi3t/following{/other_user}","gists_url":"https://api.github.com/users/harryi3t/gists{/gist_id}","starred_url":"https://api.github.com/users/harryi3t/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/harryi3t/subscriptions","organizations_url":"https://api.github.com/users/harryi3t/orgs","repos_url":"https://api.github.com/users/harryi3t/repos","events_url":"https://api.github.com/users/harryi3t/events{/privacy}","received_events_url":"https://api.github.com/users/harryi3t/received_events","type":"User","site_admin":false},{"login":"kamalaknn","id":8401064,"node_id":"MDQ6VXNlcjg0MDEwNjQ=","avatar_url":"https://avatars3.githubusercontent.com/u/8401064?v=4","gravatar_id":"","url":"https://api.github.com/users/kamalaknn","html_url":"https://github.com/kamalaknn","followers_url":"https://api.github.com/users/kamalaknn/followers","following_url":"https://api.github.com/users/kamalaknn/following{/other_user}","gists_url":"https://api.github.com/users/kamalaknn/gists{/gist_id}","starred_url":"https://api.github.com/users/kamalaknn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kamalaknn/subscriptions","organizations_url":"https://api.github.com/users/kamalaknn/orgs","repos_url":"https://api.github.com/users/kamalaknn/repos","events_url":"https://api.github.com/users/kamalaknn/events{/privacy}","received_events_url":"https://api.github.com/users/kamalaknn/received_events","type":"User","site_admin":false},{"login":"preethammavin","id":34742239,"node_id":"MDQ6VXNlcjM0NzQyMjM5","avatar_url":"https://avatars0.githubusercontent.com/u/34742239?v=4","gravatar_id":"","url":"https://api.github.com/users/preethammavin","html_url":"https://github.com/preethammavin","followers_url":"https://api.github.com/users/preethammavin/followers","following_url":"https://api.github.com/users/preethammavin/following{/other_user}","gists_url":"https://api.github.com/users/preethammavin/gists{/gist_id}","starred_url":"https://api.github.com/users/preethammavin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/preethammavin/subscriptions","organizations_url":"https://api.github.com/users/preethammavin/orgs","repos_url":"https://api.github.com/users/preethammavin/repos","events_url":"https://api.github.com/users/preethammavin/events{/privacy}","received_events_url":"https://api.github.com/users/preethammavin/received_events","type":"User","site_admin":false}],"milestone":null,"comments":3,"created_at":"2018-05-31T12:51:15Z","updated_at":"2018-07-02T10:03:51Z","closed_at":"2018-06-29T10:49:24Z","author_association":"NONE","body":"**Describe the bug**\r\nWhen using valid client certificate (provided as chained PEM certificate and private key in settings for domain under test) issued by valid intermediate root CA (present in supplied bundled CRT certificate and in both root CA stores) to access SSL endpoint protected by SSL and client certificate authentication, error \"UNABLE_TO_VERIFY_LEAF_SIGNATURE\" is received instead of expected HTTP response.\r\n\r\n**To Reproduce**\r\nSteps to reproduce the behavior:\r\n1. Prepare all certificates: \"Root CA\", \"Intermediate Root CA\" issued by \"Root CA\", client certificate issued by \"Intermediate Root CA\", web site's SSL certificate\r\n2. Ensure all certificates are valid and without errors, added to all appropriate certificate stores (on both client and server in certificate stores where needed) and that web site under test is secured with valid SSL certificate and with mandatory Client Certificate authentication and that requests to the endpoint under test from Chrome and Firefox browsers can go without any issues (that all certificates are accepted without exceptions and errors).\r\n2. Open Postman 6.1.3 for Windows\r\n3. Set bundled (client + issuing CA + issuer's parent root CA) client certificate (PEM format) and private key in \"Settings > Certificates\"  for the web site (endpoint) under test.\r\n4. Make request to the web site under test\r\n5. Error \"UNABLE_TO_VERIFY_LEAF_SIGNATURE\" is seen in Postman Console and no HTTP connection is established.\r\n\r\n**Expected behavior**\r\nRequest to the web site under test goes through and expected response is received (meaning TLS handshake was successful and HTTP connection was established regardless of the server's HTTP response).\r\n\r\n**App information (please complete the following information):**\r\n - Native App\r\n - Postman Version 6.1.3\r\n - Windows 10 Professional (with all current updates installed)\r\n\r\n**Additional context**\r\nSite under test was using self signed SSL for \"localhost\" certificate auto generated by Visual Studio (IIS Express) which was present in Computer's Personal and User's Trusted Root CA certificates store. Postman was able to receive answers without any problems from the same SSL secured endpoint when client certificate authentication was not turned on.\r\n\r\nWhen option in settings \"SSL certificate verification\" is turned off, requests (with client certificate authentication that is verified on the server) goes through fine, but that is due to the fact that any \"validation\" is turned off. The root cause for this issue probably can not be the same as other currently opened issues related to client certificate authentication problems (like #2874,  #3251, #3290).\r\n\r\nIssuing the same request from Chrome and Firefox browser (with configuring client certificate in Firefox and adding localhost SSL certificate in Trusted Publishers) works as expected and without any issue.\r\n\r\nAll requests were tested with all proxies turned off (in both browsers and Postman) and with using default system configured proxy (which technically in this case would be none) and results were the same.\r\n\r\nAll certificates (client and all chained parent CAs and web site) are inspected through MMC (in all required stores), as the ones supplied to Postman and appears as valid and not marked with any issues.\r\n\r\nThis issue in particular seems to be related to the fact that client certificate is issued by intermediary root CA (root CA issued by another root CA) and that Postman (or underlining engine) for whatever reason does not properly resolves/validates CA chain (even though CA chain is properly supplied in bundled client certificate and is valid and in all relevant secure stores). Root cause might be the same as described here https://stackoverflow.com/questions/20082893/unable-to-verify-leaf-signature/48563954#48563954"},"comment":{"url":"https://api.github.com/repos/postmanlabs/postman-app-support/issues/comments/401745970","html_url":"https://github.com/postmanlabs/postman-app-support/issues/4627#issuecomment-401745970","issue_url":"https://api.github.com/repos/postmanlabs/postman-app-support/issues/4627","id":401745970,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMTc0NTk3MA==","user":{"login":"harryi3t","id":5207331,"node_id":"MDQ6VXNlcjUyMDczMzE=","avatar_url":"https://avatars2.githubusercontent.com/u/5207331?v=4","gravatar_id":"","url":"https://api.github.com/users/harryi3t","html_url":"https://github.com/harryi3t","followers_url":"https://api.github.com/users/harryi3t/followers","following_url":"https://api.github.com/users/harryi3t/following{/other_user}","gists_url":"https://api.github.com/users/harryi3t/gists{/gist_id}","starred_url":"https://api.github.com/users/harryi3t/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/harryi3t/subscriptions","organizations_url":"https://api.github.com/users/harryi3t/orgs","repos_url":"https://api.github.com/users/harryi3t/repos","events_url":"https://api.github.com/users/harryi3t/events{/privacy}","received_events_url":"https://api.github.com/users/harryi3t/received_events","type":"User","site_admin":false},"created_at":"2018-07-02T10:03:51Z","updated_at":"2018-07-02T10:03:51Z","author_association":"NONE","body":"@EasyMilos Can you try with 127.0.0.1 instead of localhost?"}}
{"actor":{"display_login":"harryi3t"}}