New issue
Advanced search Search tips

Issue 534766 link

Starred by 4 users

Issue metadata

Status: Fixed
Closed: Sep 2015
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug-Regression

Sign in to add a comment

Unable to use client certificate with MSB=0 bad encoding

Reported by, Sep 22 2015

Issue description

UserAgent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.33 Safari/537.36

Example URL:

Steps to reproduce the problem:
Steps to reproduce the problem:
1. Chrome 46
2. Estonian ID-card
3. Try to authenticate to testsite for example
4. Authentication fails: certificate selection dialog is displayed but after that it fails without pin entry with error ERR_SSL_PROTOCOL_ERROR
5. Boringssl internal error is BAD_ENCODING.

What is the expected behavior?
Authentication should be success

What went wrong?

Did this work before? Yes chrome 45

Chrome version: 46.0.2490.33  Channel: beta
OS Version: 6.1 (Windows 7, Windows Server 2008 R2)
Flash Version: Shockwave Flash 19.0 r0

During the investigation we found this issue.

There is almost same amount of certificates affected as in ticket 532048. 
The temporary workaround should be based on similar grounds as in ticket 532048.
1.8 KB Download
Labels: -Cr-Internals-Network Cr-Internals-Network-SSL
Labels: -Type-Bug Type-Bug-Regression M-46
Status: Started
Fun times. Alright, here's another workaround. Please confirm that newly-issued IDs no longer have this issue and that these too can be resolved in six months.
Project Member

Comment 3 by, Sep 23 2015

The following revision refers to this bug:

commit 4c60d356a926b68ac20e8090755799e1525874f0
Author: David Benjamin <>
Date: Wed Sep 23 16:23:01 2015

Work around even more Estonian ID card misissuances.

Not content with signing negative RSA moduli, still other Estonian IDs have too
many leading zeros. Work around those too.

This workaround will be removed in six months.

BUG= 534766 

Change-Id: Ica23b1b1499f9dbe39e94cf7b540900860e8e135
Reviewed-by: Adam Langley <>


Yeah, fun indeed :) Thanks for quick response.
New ones are ok and 6 months planned to resolve.
Will look into workaround.
Confirmed - workaround works for certificates in focus. Please continue to merge in M46
Er, how did you test this? Rolling the change into Chromium is still making its way through the system. I'm not going to request a merge until probably tomorrow when the change has hit the canary channel and no problems have come up.
We checked out latest bssl and modified to check those certificates against bssl.
Usage: tool/bssl [client|genrsa|md5sum|pkcs12|rand|s_client|s_server|server|sha1sum|sha224sum|sha256sum|sha384sum|sha512sum|speed]
Path /../37101010021.cer
Cert OK

Project Member

Comment 8 by, Sep 24 2015

The following revision refers to this bug:

commit b5fe77ecea369e669d76b067c42334f9382b441b
Author: davidben <>
Date: Thu Sep 24 19:44:17 2015

Roll src/third_party/boringssl/src 231cb8214..4c60d356a

This rolls just before the signing digest changes to make
sure the new Estonia workaround gets into the next canary.

BUG= 534766 

Review URL:

Cr-Commit-Position: refs/heads/master@{#350619}


Labels: Merge-Request-46
Sorry TPMs, there's another one of these. :-( Apparently Estonian IDs managed to screw something else up too, so we have to work around this bug as well. And, of course, it was only reported the day after I'd already merged the other workaround.

I'd like to merge to M46. The only non-comment, non-test change is removal of a block of code in crypto/bn/bn_asn1.c.

This is a funny DEPS change, so it would amount to moving boringssl_revision to 8f7f3837b88197e571159b84efdaa8ad23712a99 which is a cherry-pick of the change onto where Chromium branched BoringSSL:

Comment 10 by, Sep 25 2015

Labels: -Merge-Request-46 Merge-Review-46 Hotlist-Merge-Review
[Automated comment] DEPS changes referenced in bugdroid comments, needs manual review.

Comment 11 by, Sep 25 2015

Labels: -Merge-Review-46 Merge-Approved-46
Merge approved for M46 branch (branch: 2490).
Project Member

Comment 12 by, Sep 25 2015

Labels: -Merge-Approved-46 merge-merged-2490
The following revision refers to this bug:

r78887 | | 2015-09-25T18:07:29.665615Z

Status: Fixed
Project Member

Comment 14 by, May 10 2017

The following revision refers to this bug:

commit 1d59f6e3e2f3acef7498635adad4de0540433f72
Author: David Benjamin <>
Date: Wed May 10 15:49:33 2017

Add a flag to toggle the buggy RSA parser.

It's about time we got rid of this. As a first step, introduce a flag,
so that some consumers may stage this change in appropriately.

BUG= chromium:534766 , chromium:532048 

Change-Id: Id53f0bacf5bdbf85dd71d1262d9f3a9ce3c4111f
Reviewed-by: Adam Langley <>
Commit-Queue: David Benjamin <>
CQ-Verified: CQ bot account: <>


Sign in to add a comment