626022 - verify irc.m.o GeoTrust intermediate chaining for OS X clients

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: Infrastructure: IRC, task)

Description

[Matt Nordhoff (aka Peng on IRC & forums)]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Build Identifier: 

The irc.mozilla.org IRC servers use a very fine SSL cert...but it's only valid for irc.mozilla.org, so if you configure your client to connect directly to one of the servers, there will be a mismatch.

There are *.mozilla.org certs somewhere -- see https://www.mozilla.org/ -- or you could create a new irc.mozilla.org cert that includes some subjectAltNames. (I wonder how many obscure IRC clients are broken by either of those... [Freenode uses wildcards and irssi apparently supports subjectAltName.])

Reproducible: Always

Steps to Reproduce:
You can take a look at the cert in a browser by visiting https://sand.mozilla.org:6697/ or https://concrete.mozilla.org:6697/

Comment 1

[Dave Miller [:justdave]]

I vote for wontfix on the grounds that users should be discouraged from specifically connecting to one of these servers because that breaks our ability to redirect them elsewhere via DNS in order to perform maintenance and so forth. Users smart enough to know they have a need to override our choice of server for them are probably also smart enough to tell their client to accept a mismatched certificate.

If geographic location is a concern, we're planning to get these into geodns soon instead of a round-robin like they are currently.

Comment 2

[Dave Miller [:justdave]]

(In reply to comment #1)
> Users smart enough to know they have a need to override our choice of
> server for them are probably also smart enough to tell their client to accept
> a mismatched certificate.

Or a smarter plan would be to put the node they desire into their hosts file with the irc.mozilla.org hostname (so then the cert could still validate).

Comment 3

[Matt Nordhoff (aka Peng on IRC & forums)]

I don't disagree about discouraging users from bypassing the round-robin, but personally, I'm smart enough to know I'm asking for trouble when I do it, but not smart enough to know how to configure my IRC client to accept the hostname mismatch but otherwise require a valid cert. (I'm not using ChatZilla.)

Using /etc/hosts works, I guess, but it's such a hack.

I recall one occasion on which the server irc.mozilla.org pointed to was down, but one of the other servers was up. No doubt it was fixed shortly, but it makes me more comfortable to configure my IRC client to try the specific servers if irc.mozilla.org fails, and I'd prefer SSL to work without issue when that happens.

It's really not worth your time and money to fix this, but it would make me a little happy. :P

Comment 4

[Cameron McCormack (:heycam)]

I have X-Chat set to connect to irc.mozilla.org, but I get certificate failures.  Is it that X-Chat follows the CNAME and compares the result against the name in the certificate?  If so, is that incorrect behaviour?

 * Looking up irc.mozilla.org
 * Connecting to sand.mozilla.org (63.245.208.159) port 6697...
 * * Subject: /C=US/O=GeoTrust, Inc./CN=GeoTrust SSL CA
 * * Issuer: /C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
 * * Subject: /C=US/O=GeoTrust, Inc./CN=GeoTrust SSL CA
 * * Issuer: /C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
 * * Subject: /serialNumber=jJNoDeAj2XruggOCC/9OznpNC/MoRdVu/C=US/ST=California/L=Mountain View/O=Mozilla Corporation/OU=Mozilla IT/CN=irc.mozilla.org
 * * Issuer: /C=US/O=GeoTrust, Inc./CN=GeoTrust SSL CA
 * * Certification info:
 *   Subject:
 *     serialNumber=jJNoDeAj2XruggOCC
 *     9OznpNC
 *     MoRdVu
 *     C=US
 *     ST=California
 *     L=Mountain View
 *     O=Mozilla Corporation
 *     OU=Mozilla IT
 *     CN=irc.mozilla.org
 *   Issuer:
 *     C=US
 *     O=GeoTrust, Inc.
 *     CN=GeoTrust SSL CA
 *   Public key algorithm: rsaEncryption (2048 bits)
 *   Public key algorithm uses ephemeral key with 7975 bits
 *   Sign algorithm sha1WithRSAEncryption (0 bits)
 *   Valid since May 13 08:04:38 2011 GMT to Aug 14 08:36:01 2013 GMT
 * * Cipher info:
 *   Version: TLSv1/SSLv3, cipher AES256-SHA (256 bits)
 * Connection failed. Error: certificate not trusted.? (27)

Comment 5

[:Atoll]

We have, since 2011, resolved several issues with our IRC server certificates, and it's generally understood by us that as of last year or so, our IRC SSL certificates are correctly configured.

If you're still experiencing issues with this, please reopen; otherwise I am marking this RESOLVED WORKSFORME based on widespread evidence.

Comment 6

[Cameron McCormack (:heycam)]

Just a couple of days ago, I looked again into why X-Chat had trouble verifying the IRC server certificate.  I added GeoTrust to OS X's openssl's listed of trusted certificates and now I have no problem connecting.

Comment 7

[:Atoll]

Hmm. I'll reopen and take this. We might be serving the GeoTrust certificate incorrectly.

What version of OS X are you using?

Comment 8

[Cameron McCormack (:heycam)]

10.9.2.  I assumed that the openssl install that OS X has just doesn't include the GeoTrust certificate, although I don't know how to check that.

Comment 9

[Brian Hourigan [:digi]]

I think this problem is OSX specific, and not a problem with our SSL certificate on irc.m.o. According to a Apple KB article[1] SSL certificate management is handled by the users keychain, which may not be supported by X-Chat. I don't think X-Chat has native OSX support. It doesn't look like X-Chat is maintained. It hasn't had a release since 2010[2].

[1] http://support.apple.com/kb/PH10967
[2] http://xchat.org/

On Debian I am able to verify the chain of trust to irc.mozilla.org:

bhourigan@miranda ~ % openssl s_client -connect irc.mozilla.org:6697 -CApath /etc/ssl/certs
CONNECTED(00000003)
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify return:1
depth=1 C = US, O = "GeoTrust, Inc.", CN = GeoTrust SSL CA
verify return:1
depth=0 serialNumber = A7/cAN-TICcVTifiF1F5wuRPLpK75-AJ, C = US, ST = California, L = Mountain View, O = Mozilla Corporation, CN = irc.mozilla.org
verify return:1
---
Certificate chain
 0 s:/serialNumber=A7/cAN-TICcVTifiF1F5wuRPLpK75-AJ/C=US/ST=California/L=Mountain View/O=Mozilla Corporation/CN=irc.mozilla.org
   i:/C=US/O=GeoTrust, Inc./CN=GeoTrust SSL CA
 1 s:/C=US/O=GeoTrust, Inc./CN=GeoTrust SSL CA
   i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
---

Comment 10

[Dan Parsons [:lerxst]]

I don't believe this is a problem with our new IRC network, but if anyone is able to reproduce it, please re-open this bug.