647722 - certificateUsageSSLClient causes CERT_PKIXVerifyCert to build a certification loop

Status: REOPENED

(NSS :: Libraries, defect, P5)

Description

[Kai Engert (:KaiE:)]

My experimental PSM code that uses CERT_PKIXVerifyCert fails.

In order to find a simple test case, I used https://wiki.mozilla.org
(With the cert from that site the pkix debug logs aren't getting as big as for most other sites)

I'l attach a log file.
(I enabled debugging #define in pkix_build.c


Failure is PKIX_LOOPDISCOVEREDDUPCERTSNOTALLOWED


$7 = {errCode = PKIX_BUILDINITIATEBUILDCHAINFAILED, errClass = PKIX_BUILD_ERROR, plErr = 0, cause = 0xa3b8c6a0, info = 0x0}
(gdb) print *error->cause
$8 = {errCode = PKIX_UNABLETOBUILDCHAIN, errClass = PKIX_BUILD_ERROR, plErr = 0, cause = 0xa3b8c7a0, info = 0x0}
(gdb) print *error->cause->cause
$9 = {errCode = PKIX_BUILDFORWARDDEPTHFIRSTSEARCHFAILED, errClass = PKIX_BUILD_ERROR, plErr = 0, cause = 0xa3b8c3a0, info = 0x0}
(gdb) print *error->cause->cause->cause
$10 = {errCode = PKIX_LOOPDISCOVEREDDUPCERTSNOTALLOWED, errClass = PKIX_BUILD_ERROR, plErr = 4294959124, cause = 0x0, info = 0x0}

Comment 1

[Kai Engert (:KaiE:)]

Attachment: logfile

Comment 2

[Kai Engert (:KaiE:)]

bug still exists with tip of NSS, as of today.

Comment 3

[Kai Engert (:KaiE:)]

I would expect that PKIX_PL_Cert_IsCertTrusted(builtin-root) returns true.
However, for the root CA in this scenario, this function returns not-trusted.

The issue might be inside pkix_pl_Pk11CertStore_CheckTrust

The SSL client code passes cert-usage certUsageSSLClient,
and pkix concludes that it needs trust bits 128,
but it has 24, so it fails.

Comment 4

[Kai Engert (:KaiE:)]

oh... SECCertUsage != SECCertificateUsage

Comment 5

[Kai Engert (:KaiE:)]

I think this bug is invalid.
My mistake.
I used the wrong cert usage constants...

Comment 6

[Wan-Teh Chang]

Kai: I also ran into this bug last week, so I think it
is worth getting to the bottom of this bug.

As an experiment, I passed certificateUsageSSLClient instead
of certificateUsageSSLServer, as an experiment.  I was
expecting to get the SEC_ERROR_INADEQUATE_KEY_USAGE error.
But I was surprised to get SEC_ERROR_UNTRUSTED_ISSUER, caused
by PKIX_LOOPDISCOVEREDDUPCERTSNOTALLOWED.

Note that certificateUsageSSLClient is a valid SECCertificateUsage
value.  But even with an invalid cert usage constant, isn't it
strange that it causes libpkix to build a certification loop?

Comment 7

[Kai Engert (:KaiE:)]

(In reply to comment #6)
> But even with an invalid cert usage constant, isn't it
> strange that it causes libpkix to build a certification loop?

agreed

Comment 8

[Wan-Teh Chang]

Kai: did you pass certUsageSSLServer as the SECCertificateUsage
argument?  certUsageSSLServer has the same value as
certificateUsageSSLClient, so you actually ran into the exact
same problem as I did.

Comment 9

[Kai Engert (:KaiE:)]

(In reply to comment #8)
> Kai: did you pass certUsageSSLServer as the SECCertificateUsage
> argument?

Yes, that's exactly what I did.