New issue
Advanced search Search tips

Issue 607544 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 579480
Owner: ----
Closed: Apr 2016
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

SSL client certificate chain is not sent

Reported by msierad...@opera.com, Apr 28 2016

Issue description

UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.110 Safari/537.36 OPR/36.0.2130.65

Example URL:

Steps to reproduce the problem:
1. Connect to HTTPS URL that requires client certifcate (with server checking if cert is signed by CA at least 2 levels higher)

What is the expected behavior?
Certificate is accepted and URL loads

What went wrong?
"Certificate-based authentication failed"

Did this work before? N/A 

Chrome version: 49.0.2623.110  Channel: n/a
OS Version: Ubuntu 16.04
Flash Version: Shockwave Flash 21.0 r0

I have client cert A signed by B signed by C. Server trusts C. I select A as certificate to be sent to the server.

Chromium rev 338772 works fine. Rev 338893 fails. client_cert_store_nss.cc in ClientCertStoreNSS::GetPlatformCertsOnWorkerThread contains X509Certificate::CreateFromHandle with empty intermediates argument. That causes intermediate not to be set on the certificate. Intermediate CA cert is not sent during SSL connection and server rejects client certificate.
 
I think that it worked before due to coincidence: NSS was used for SSL and for certificate DB. NSS looked up certificate chain on its own, even though it wasn't given any chain information for the client certificate.
Components: -Internals>Network Internals>Network>SSL
Mergedinto: 579480
Status: Duplicate (was: Unconfirmed)

Sign in to add a comment