398153 - Certificate path validation fails / windows and openssl works fine

Status: RESOLVED DUPLICATE of bug 386871

(Thunderbird :: Security, defect)

Description

[Stefan Selbitschka]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.6) Gecko/20061201 Firefox/2.0.0.6 (Ubuntu-feisty)
Build Identifier: 2.0.0.4

Hi!

I have a chain of 4 certificates (end-entity to root) which works fine in windows and with openssl, but thunderbird don't resolve the chain. It seems that the first step of path validation end-entity to issuer fails, because I can import the chain correctly to the root store, but can't import the end-entity certificate under "other people's".

Reproducible: Always

Steps to Reproduce:
1. Import the all root and intermediate certificates
2. Try to import the end-entity certificate under "other people's"
Actual Results:  
Alert "The certificate can't be verified ....."

Expected Results:  
Certificate should be imported, since all root and intermediate certificates are present.

If you try "openssl verify -CAfile test_chain.pem  test_certificate.pem" you'll get "OK" for the path validation.

Certificates:
root:
-----BEGIN CERTIFICATE-----
MIIDzzCCAregAwIBAgIDAWweMA0GCSqGSIb3DQEBBQUAMIGNMQswCQYDVQQGEwJB
VDFIMEYGA1UECgw/QS1UcnVzdCBHZXMuIGYuIFNpY2hlcmhlaXRzc3lzdGVtZSBp
bSBlbGVrdHIuIERhdGVudmVya2VociBHbWJIMRkwFwYDVQQLDBBBLVRydXN0LW5R
dWFsLTAzMRkwFwYDVQQDDBBBLVRydXN0LW5RdWFsLTAzMB4XDTA1MDgxNzIyMDAw
MFoXDTE1MDgxNzIyMDAwMFowgY0xCzAJBgNVBAYTAkFUMUgwRgYDVQQKDD9BLVRy
dXN0IEdlcy4gZi4gU2ljaGVyaGVpdHNzeXN0ZW1lIGltIGVsZWt0ci4gRGF0ZW52
ZXJrZWhyIEdtYkgxGTAXBgNVBAsMEEEtVHJ1c3QtblF1YWwtMDMxGTAXBgNVBAMM
EEEtVHJ1c3QtblF1YWwtMDMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
AQCtPWFuA/OQO8BBC4SAzewqo51ru27CQoT3URThoKgtUaNR8t4j8DRE/5TrzAUj
lUC5B3ilJfYKvUWG6Nm9wASOhURh73+nyfrBJcyFLGM/BWBzSQXgYHiVEEvc+RFZ
znF/QJuKqiTfC0Li21a8StKlDJu3Qz7dg9MmEALP6iPESU7l0+m0iKsMrmKS1GWH
2WrX9IWf5DMiJaXlyDO6w8dB3F/GaswADm0yqLaHNgBid5seHzTLkDx4iHQF63n1
k3Flyp3HaxgtPVxO59X4PzF9j4fsCiIvI+n+u33J4PTs63zEsMMtYrWacdaxaujs
2e3Vcuy+VwHOBVWf3tFgiBCzAgMBAAGjNjA0MA8GA1UdEwEB/wQFMAMBAf8wEQYD
VR0OBAoECERqlWdVeRFPMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOC
AQEAVdRU0VlIXLOThaq/Yy/kgM40ozRiPvbY7meIMQQDbwvUB/tOdQ/TLtPAF8fG
KOwGDREkDg6lXb+MshOWcdzUzg4NCmgybLlBMRmrsQd7TZjTXLDR8KdCoLXEjq/+
8T/0709GAHbrAvv5ndJAlseIOrifEXnzgGWovR/TeIGgUUw3tKZdJXDRZslo+S4R
FGjxVJgIrCaSD96JntT6s3kr0qN51OyLrIdTaEJMUVF0HhsnLuP1Hyl0Te2v9+GS
mYHovjrHF1D2t8b8m7CKa9aIA5GPBnc6hQLdmNVDeD/GMBWsm2vLV7eJUYs66MmE
DNuxUCAKGkq6ahq97BvIxYSazQ==
-----END CERTIFICATE-----

interm1:
-----BEGIN CERTIFICATE-----
MIIEiTCCA3GgAwIBAgIDAnQ8MA0GCSqGSIb3DQEBBQUAMIGNMQswCQYDVQQGEwJB
VDFIMEYGA1UECgw/QS1UcnVzdCBHZXMuIGYuIFNpY2hlcmhlaXRzc3lzdGVtZSBp
bSBlbGVrdHIuIERhdGVudmVya2VociBHbWJIMRkwFwYDVQQLDBBBLVRydXN0LW5R
dWFsLTAzMRkwFwYDVQQDDBBBLVRydXN0LW5RdWFsLTAzMB4XDTA2MDkwNjIyMDAw
MFoXDTE2MDkwNjIyMDAwMFowgZkxCzAJBgNVBAYTAkFUMUgwRgYDVQQKDD9BLVRy
dXN0IEdlcy4gZi4gU2ljaGVyaGVpdHNzeXN0ZW1lIGltIGVsZWt0ci4gRGF0ZW52
ZXJrZWhyIEdtYkgxHzAdBgNVBAsMFmEtc2lnbi1jb21wYW55LXJvb3QtMDMxHzAd
BgNVBAMMFmEtc2lnbi1jb21wYW55LXJvb3QtMDMwggEiMA0GCSqGSIb3DQEBAQUA
A4IBDwAwggEKAoIBAQCc8+CBH0eDg+aN8q3BdMiYxr2xqnBs/QXC1Qvw5TjlcvlA
Qm6iG1Nw7VqAp60zF5WgPnBvjAyClDTjlU6/n9NGYlYjvbwCV1nzm5m5+3l39UKw
xF4+ys6bUYZN4CGSDhD+BYv9FdWJpdZo2XajSoXTYg4TKdfbLuzs4MChyL0RfsAI
1w3BoIdeiqUnIUpGRHOmwanB0lZ1fPUhj5gJ30j/I0kGbyjY+b0tWy3gAMWGzYGv
AdnkuCBhSBCE67HVgxk10hR45uMPlmKVYKDfiJ6LEgjg1aXuElUchfJ/R6QSJsHu
bwtr8VUStAPhAz2sXrgESL4nxYB4CHfy1XYyIqsvAgMBAAGjgeMwgeAwDwYDVR0T
AQH/BAUwAwEB/zARBgNVHQ4ECgQIR7AI1/mfXfIwEwYDVR0jBAwwCoAIRGqVZ1V5
EU8wDgYDVR0PAQH/BAQDAgEGMIGUBgNVHR8EgYwwgYkwgYaggYOggYCGfmxkYXA6
Ly9sZGFwLmEtdHJ1c3QuYXQvb3U9QS1UcnVzdC1uUXVhbC0wMyxvPUEtVHJ1c3Qs
Yz1BVD9jZXJ0aWZpY2F0ZXJldm9jYXRpb25saXN0P2Jhc2U/b2JqZWN0Y2xhc3M9
ZWlkQ2VydGlmaWNhdGlvbkF1dGhvcml0eTANBgkqhkiG9w0BAQUFAAOCAQEAebCL
1Rl4LaYk4tjJSEYvkUQzYBeIHQjtgUfLTM0CmbMguqdSvf/x6TQs4Q8WSuDZiShk
z7IjRxMiZtIoEvfO6V3E+78xShBD4FfZ9/31T3LrQ6xTS+FpR6mY3b2Mqv4gln+4
s5qoqf8njdfRpfJqlRthS6MULlfB+BE5Q0bfEkm/5iTdpnSzlmdS3qS21LIUBdo2
9crEk+CsnnkI9G3uZpSo5hS0khkN/mS/PwY167BbOpNO4jnDABQC7CoEhjMyA5Ob
TWC0MQXaejynZbgSxCfmJhW3hQ4CyxxAjPHcjBbvq0SYRqBt1mkSMzzKfM7HG3X1
/a9JvC5EbGrU9VhgLQ==
-----END CERTIFICATE-----

interm 2:
-----BEGIN CERTIFICATE-----
MIIEWTCCA0GgAwIBAgIDAxH2MA0GCSqGSIb3DQEBBQUAMIGZMQswCQYDVQQGEwJB
VDFIMEYGA1UECgw/QS1UcnVzdCBHZXMuIGYuIFNpY2hlcmhlaXRzc3lzdGVtZSBp
bSBlbGVrdHIuIERhdGVudmVya2VociBHbWJIMR8wHQYDVQQLDBZhLXNpZ24tY29t
cGFueS1yb290LTAzMR8wHQYDVQQDDBZhLXNpZ24tY29tcGFueS1yb290LTAzMB4X
DTA3MDMyNjEwMDAwMFoXDTE3MDMyNjEwMDAwMFowVzELMAkGA1UEBhMCQVQxJTAj
BgNVBAoMHFJhaWZmZWlzZW4gQmF1c3Bhcmthc3NlIEdtYkgxITAfBgNVBAMMGFJh
aUJhdSBDb21wYW55IE1haWwgUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBAMBthb06ADhboTTGerjWyw0tId8vdVtINDAqDFJ7jlm7lp//OlF3lvsT
zP9p1Q+VORsGzT7kY7U1uUAHhY2afPaPHWnUKZq05h+lNLV+WH4N/CiOKhapzpnC
6fAzXpMVeSduosZNi1rXnkezkZSGBEcf9BezMmTpsQIPQ9q92a/G4FxbteWRrwn2
sjrCzY1i9sf8A4+RmhY80LUnitxO36HraMdCMOyywpCiS8jmk6ay6h7ZWiPFi/Ix
gkT+hr6oLWAPCyXIIC3MXw8f4Lc62fWbkfzrQDySocI0477CQs9kQozFyoeqJeGw
8Xvs/N2EIEhvQT/GWhWo/d2dVV5RdTkCAwEAAaOB6jCB5zAPBgNVHRMBAf8EBTAD
AQH/MBEGA1UdDgQKBAhGdHG6CFNUAjATBgNVHSMEDDAKgAhHsAjX+Z9d8jAOBgNV
HQ8BAf8EBAMCAQYwgZsGA1UdHwSBkzCBkDCBjaCBiqCBh4aBhGxkYXA6Ly9sZGFw
LmEtdHJ1c3QuYXQvb3U9YS1zaWduLWNvbXBhbnktcm9vdC0wMyxvPUEtVHJ1c3Qs
Yz1BVD9jZXJ0aWZpY2F0ZXJldm9jYXRpb25saXN0P2Jhc2U/b2JqZWN0Y2xhc3M9
ZWlkQ2VydGlmaWNhdGlvbkF1dGhvcml0eTANBgkqhkiG9w0BAQUFAAOCAQEABMY8
4w9XWRhQOIxqGw5nK9fTVmAmbJf7DPbrzYQmfZyBAbUSZiE9gSXePaIrbIH5cF1X
nWLvU9UNdCMRrcSz7yxwE5i8Co+niSB+GY3F/32uDM/MrwFrRtarealeI2Kj1EtC
DRIrNEoRs4ASqJQ5AkaURXs1t/QzpPabhOOinUvnFO+l4tRCVw3VUdhIZBHRlzxo
yfxJF8C0nFvx1qa/979DrKfIeeJ/xYyZVChg1wif7DHSlRvF8sudztHpXaHockYw
M2W3zcDRJWyaA+YLFZajHQSstPu85Ij9SOLudPkO/ehVG3Hmt4QbNhlqUyT7XvvS
YG548+uqfNm9CMnsug==
-----END CERTIFICATE-----

end-entity:
-----BEGIN CERTIFICATE-----

MIIEEzCCAvugAwIBAgIJAJJKfA7cbomgMA0GCSqGSIb3DQEBBQUAMFcxCzAJBgNV

BAYTAkFUMSUwIwYDVQQKExxSYWlmZmVpc2VuIEJhdXNwYXJrYXNzZSBHbWJIMSEw

HwYDVQQDExhSYWlCYXUgQ29tcGFueSBNYWlsIFJvb3QwHhcNMDcwMzI2MTQzMzQz

WhcNMTIwMzI0MTQzMzQzWjBSMQswCQYDVQQGEwJBVDElMCMGA1UECgwcUmFpZmZl

aXNlbiBCYXVzcGFya2Fzc2UgR21iSDEcMBoGA1UEAwwTUmFpQmF1IENvbXBhbnkg

TWFpbDCB3zANBgkqhkiG9w0BAQEFAAOBzQAwgckCgcEA3uj4/fVydwQy731JDYdC

P4e2Ug79m69mxCBuXo3+YDLc+ApIm2GAekBSgvMTuRjXsj4RWmTa5pXQrS0yFt0N

y7xH9O9M6bzsvLmZMN6h2nYAIgfZaqwCijbrKbKa5kUMLyE6Z9G2Ro8vV7LHmy7T

MCA9m2BJEjsUY7ee2IvlXkNwNYDBZ4XtuITMulPQduP6YInv0dLQt3Ftizq1MLKv

HA9vaNA/6BjsC+KFWSXH+tD+Um/a6I8QMXWJGDGpqic5AgMBAAGjggEpMIIBJTAr

BgNVHREBAf8EITAfgR1IZXJiZXJ0LkJBVU1HQVJUTkVSQHJhaWJhdS5hdDAJBgNV

HRMEAjAAMB0GA1UdDgQWBBQsmoQu8i3k6XcjhbnNIYeU3ZtqeTATBgNVHSMEDDAK

gAhGdHG6CFNUAjAOBgNVHQ8BAf8EBAMCBLAwUQYIKwYBBQUHAQEERTBDMEEGCCsG

AQUFBzAChjVodHRwOi8vd3d3LmEtdHJ1c3QuYXQvY2VydHMvUmFpQmF1Q29tcGFu

eU1haWxSb290LmNydDBUBgNVHSAETTBLMEkGByooABEBDwEwPjA8BggrBgEFBQcC

ARYwaHR0cDovL3d3dy5hLXRydXN0LmF0L2RvY3MvY3AvYS1zaWduLW1haWwtcmFp

YmF1MA0GCSqGSIb3DQEBBQUAA4IBAQB4akPSiMDVtecXPIlVZWyQpKZBa0ON4+q+

HK+XK1yy5oYHI6gkHefJ6EHyfI/spqRB1aTNDCR9s/Fy2u6eXb4jwq/3/XcDewqN

jjoRh+P8YBt8k5HyfaX+VY9fSOxh75jNm3dWvjfi1uMMAvM1piOSEEHeo0MsrnSa

7YrOmIzRPk5WQkoMbX9HrwBjOcKLPdAVpaP9rdxo7iUJWjVi0b7tgw9X0JML094R

SH4XRhw+ZKHG389LnQSxwRZaB1q98arTbiFBfXLmsAPQVG9adhGYHrQm5UUy2HNm

u2NHIBZSOLWbVdsNPoBY9ZizbMs7dorg4l4pg9RjoF/XPL+CACsX

-----END CERTIFICATE-----

Comment 1

[Phil Ringnalda (:philor)]

Did that end-entity cert spend some time in Windows-land? And what happens if you try to import it after running dos2unix on it?

Comment 2

[Stefan Selbitschka]

Sry for the additional linefeeds, and yes indeed the cert spend some time in win-world before ;). But unfortunately the problem consists after dos2unix!

Comment 3

[Kaspar]

A duplicate of bug 386871. The DN

  C=AT, O=Raiffeisen Bausparkasse GmbH, CN=RaiBau Company Mail Root

is encoded with different ASN.1 types in the "end-entity" and in the "interm2" certificate.

In the "end-entity" cert, the issuer DN is encoded with PrintableStrings, as this extract of "derdump" output shows:

      C-Sequence  (87)
         C-Set  (11)
            C-Sequence  (9)
               Object Identifier  (3)
                  2 5 4 6 (X520 Country Name)
               Printable String  (2)
                  "AT"
         C-Set  (37)
            C-Sequence  (35)
               Object Identifier  (3)
                  2 5 4 10 (X520 Organization Name)
               Printable String  (28)
                  "Raiffeisen Bausparkasse GmbH"
         C-Set  (33)
            C-Sequence  (31)
               Object Identifier  (3)
                  2 5 4 3 (X520 Common Name)
               Printable String  (24)
                  "RaiBau Company Mail Root"


In the "interm2" cert, however, O and CN of the subject DN are encoded with UTF8String:

      C-Sequence  (87)
         C-Set  (11)
            C-Sequence  (9)
               Object Identifier  (3)
                  2 5 4 6 (X520 Country Name)
               Printable String  (2)
                  "AT"
         C-Set  (37)
            C-Sequence  (35)
               Object Identifier  (3)
                  2 5 4 10 (X520 Organization Name)
               UTF8 String  (28)
                  52 61 69 66 66 65 69 73 65 6e 20 42 61 75 73 70 61 72
                  6b 61 73 73 65 20 47 6d 62 48
         C-Set  (33)
            C-Sequence  (31)
               Object Identifier  (3)
                  2 5 4 3 (X520 Common Name)
               UTF8 String  (24)
                  52 61 69 42 61 75 20 43 6f 6d 70 61 6e 79 20 4d 61 69
                  6c 20 52 6f 6f 74


Reissuing "interm2" with the same encodings as the end-entity certs is probably the best strategy to solve the issue, for the time being (depending on the number of end-entity certs that have been issued so far).