Date: Wed, 7 Sep 2011 06:18:24 -0400 From: Jerry <jerry@seibercom.net> To: freebsd-ports@freebsd.org Subject: Re: HEADS UP: ca_root_nss seems to trip up OpenSSL on FreeBSD 7.3 Message-ID: <20110907061824.4ff5c4cd@seibercom.net> In-Reply-To: <4E66A706.2060004@FreeBSD.org> References: <4E66A706.2060004@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, 07 Sep 2011 01:04:38 +0200 Matthias Andree articulated: > Greetings, > > apparently the new /etc/ssl/cert.pem file installed by > security/ca_root_nss trips up the OpenSSL 0.9.8e in the 7.3-RELEASE > base system. I haven't tested 7.4, 8.1 or 8.2, 8-STABLE is unaffected > by the problem. > > The symptom is that some certificate chains that validate properly on > OpenSSL under FreeBSD 8-STABLE, fail to validate on 7.3. OpenSSL > claims that the root certificate weren't trusted. > > Manually editing the cert.pem file to reorder Entrust certificates up > front in reverse order helps according to Doug's findings, but chances > are that this breaks recognition of other root certificates in > exchange. > > This is also extremely hard to test because we can't possibly find > enough sites to cover for all 150+ trust anchors that the ca_root_nss > ports provides. > > Doug and I have been trying to debug this earlier today, to no avail > yet. The current suspicion is "bug in OpenSSL when reading > certificate bundles, and that bug got fixed between 0.9.8e and 0.9.8q > (possibly 0.9.8n)" -- note though that the order of certificates in a > bundle file is not supposed to make any difference. > > If someone has any insights, that will be much appreciated. > > (Doug feel free to polish this text and re-post if it turned out to be > incomprehensible. ;-)) The base system's version of "openssl" is old. Using the ports version, "OpenSSL 1.0.0d 8 Feb 2011" is in my opinion the proper way to correct this problem. Why the base system's version has not been updated to reflect the current version is something that I would love to ask; however, the usual members of the peanut gallery would only spew the usual company propaganda, "bla bla bla" and "bla bla bla", and I am not really in the mood to listen to it. Seriously, update to the current "port" version and the problem is solved. There use to be several programs that were not compatible with the "port's" version a few years ago; however, I believe I vetted those out and was instrumental in getting them corrected. In any case, this is an easy "fix". -- Jerry ✌ jerry+ports@seibercom.net Disclaimer: off-list followups get on-list replies or get ignored. Please do not ignore the Reply-To header. __________________________________________________________________ The bigger the theory the better.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20110907061824.4ff5c4cd>