2 Certificate problems

OpenSSL used with CRLs and for some CA in the certificate chain its CRL is not included in TLSCRLFile

In TLS server log in case of OpenSSL peer:

  1. failed to accept an incoming connection: from 127.0.0.1: TLS handshake with 127.0.0.1 returned error code 1: \
  2.            file s3_srvr.c line 3251: error:14089086: SSL routines:ssl3_get_client_certificate:certificate verify failed: \
  3.            TLS write fatal alert "unknown CA"

In TLS server log in case of GnuTLS peer:

  1. failed to accept an incoming connection: from 127.0.0.1: TLS handshake with 127.0.0.1 returned error code 1: \
  2.            file rsa_pk1.c line 103: error:0407006A: rsa routines:RSA_padding_check_PKCS1_type_1:\
  3.            block type is not 01 file rsa_eay.c line 705: error:04067072: rsa routines:RSA_EAY_PUBLIC_DECRYPT:paddin

CRL expired or expires during server operation

OpenSSL, in server log:

  • before expiration:
  1. cannot connect to proxy "proxy-openssl-1.0.1e": TCP successful, cannot establish TLS to [[127.0.0.1]:20004]:\
  2.            SSL_connect() returned SSL_ERROR_SSL: file s3_clnt.c line 1253: error:14090086:\
  3.            SSL routines:ssl3_get_server_certificate:certificate verify failed:\
  4.            TLS write fatal alert "certificate revoked"
  • after expiration:
  1. cannot connect to proxy "proxy-openssl-1.0.1e": TCP successful, cannot establish TLS to [[127.0.0.1]:20004]:\
  2.            SSL_connect() returned SSL_ERROR_SSL: file s3_clnt.c line 1253: error:14090086:\
  3.            SSL routines:ssl3_get_server_certificate:certificate verify failed:\
  4.            TLS write fatal alert "certificate expired"

The point here is that with valid CRL a revoked certificate is reported as “certificate revoked”. When CRL expires the error message changes to “certificate expired” which is quite misleading.

GnuTLS, in server log:

  • before and after expiration the same:
  1. cannot connect to proxy "proxy-openssl-1.0.1e": TCP successful, cannot establish TLS to [[127.0.0.1]:20004]:\
  2.              invalid peer certificate: The certificate is NOT trusted. The certificate chain is revoked.

Self-signed certificate, unknown CA

OpenSSL, in log:

  1. error:'self signed certificate: SSL_connect() set result code to SSL_ERROR_SSL: file ../ssl/statem/statem_clnt.c\
  2.              line 1924: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:\
  3.              TLS write fatal alert "unknown CA"'

This was observed when server certificate by mistake had the same Issuer and Subject string, although it was signed by CA. Issuer and Subject are equal in top-level CA certificate, but they cannot be equal in server certificate. (The same applies to proxy and agent certificates.)

To check whether a certificate contains the same Issuer and Subject entries, run:

  1. openssl x509 -in <yourcertificate.crt> -noout -text

It is acceptable for the root (top-level) certificate to have identical values for Issuer and Subject.