New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 921165 link

Starred by 2 users

Issue metadata

Status: Untriaged
Owner: ----
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Chrome
Pri: 2
Type: Bug



Sign in to add a comment

Same SSL certificate treated differently on different platforms

Project Member Reported by vkhabarov@google.com, Jan 11

Issue description

Chrome version: 71.0.3578.98
OS version: 71.0.3578.98 (ChromeOS), current Linux (Rodete)
Case#: 17913836

Description:
Same HTTPS website with self-signed certificate shows different error on Linux-based systems (Linux and ChromeOS) and others.
On Windows/MacOS it shows NET::ERR_CERT_AUTHORITY_INVALID, which allows to proceed or add to trusted
On Linux/ChromeOS it shows NET::ERR_CERT_INVALID, which doesn't give an option to proceed and adding it to trusted won't help.
I tried to bisect on Linux, but found the same behavior up to version 55, so I suspect it's not browser version related, but OpenSSL/BoringSSL issue


Steps to reproduce: 
1. Go to https://35.247.17.70/
2. Check error message

Current Behavior / Reproduction: 
NET::ERR_CERT_INVALID

Expected Behavior: 
NET::ERR_CERT_AUTHORITY_INVALID

Drive link to logs: 
Certificate file with key I used as example (on https://35.247.17.70/) - 
https://drive.google.com/open?id=1W8iWjHpu45TYaG1y3A-u1EsaelbSWsrj
Req file used to generate - 
https://drive.google.com/open?id=1fWGOgkYLbOomYZEThhNgceqEk5ZkOuUE

What I noticed is that adding Extended Key Usage triggered this error, however we had another report with certificate not having this field, so it might not be the only trigger.
 
Components: -Internals>Network>SSL Internals>Network>Certificate
Labels: -M-72 Needs-Feedback
Could you clarify the Hotlist-Enterprise? Regarding certificates, we don't presently guarantee the same error across all platforms, nor have we ever in the past. I'm trying to understand the functional impact here.

Running the cert through the various RFC 5280 linters shows that the KU MUST be marked critical, among other things. You can run it through https://crt.sh/lintcert , which will use ( https://github.com/awslabs/certlint , https://github.com/zmap/zlint , and https://github.com/kroeckx/x509lint )
Labels: -Hotlist-Enterprise
Labels: Enterprise-Triaged
Labels: Hotlist-Enterprise
Hotlist-Enterprise is used by Enteprise customer support team to track bugs affecting our enterprise customers.

Comment 5 by vkhabarov@google.com, Jan 16 (6 days ago)

re c1# - those types of certificates are used by customers for internal resources, like Cisco Management interface, as in this example. And they are really frustrated when all browsers, including Chrome, are giving them options to proceed, but not Chrome on ChromeOS.

Comment 6 by zhongyi@chromium.org, Jan 17 (5 days ago)

Cc: rsleevi@chromium.org

Sign in to add a comment