[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-talk] "Invalid Server Certificate" accessing torproject.org on Chrome/Windows

To: tor-talk@xxxxxxxxxxxxxxxxxxxx
Subject: Re: [tor-talk] "Invalid Server Certificate" accessing torproject.org on Chrome/Windows
From: Ondrej Mikle <ondrej.mikle@xxxxxxxxx>
Date: Wed, 04 Jan 2012 21:10:18 +0100
Delivered-to: archiver@xxxxxxxx
Delivery-date: Wed, 04 Jan 2012 15:10:45 -0500
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:subject:references :in-reply-to:content-type; bh=0F13HCkR+j2jztwyQ7pbA1HqreQLpe4TQCOCps0+wc0=; b=rjl8nqxkzmkGnDsxljq/NbfC5aNHGD/cegi24JaN6nl8XUArhlLpBYRHemkwp4596O Ul8AntCJ//qhz84CgLZulPRJakAO1PRPb/EGFOMwZDFfDi7UgOmh/Fdq2ucSWV5RtOue hftnHOadPqImicKlqaexPtPcCcVk20DpUJ78c=
In-reply-to: <CAM8WWJCvDein=YuVLa71u8dcLmPtpv6AFm7GxiXmex9LRudLjQ@xxxxxxxxxxxxxx>
List-archive: <http://lists.torproject.org/pipermail/tor-talk>
List-help: <mailto:tor-talk-request@lists.torproject.org?subject=help>
List-id: "This mailing list is for all discussion about theory, design, and development of Onion Routing." <tor-talk.lists.torproject.org>
List-post: <mailto:tor-talk@lists.torproject.org>
List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk>, <mailto:tor-talk-request@lists.torproject.org?subject=subscribe>
List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-talk>, <mailto:tor-talk-request@lists.torproject.org?subject=unsubscribe>
References: <CAM8WWJCvDein=YuVLa71u8dcLmPtpv6AFm7GxiXmex9LRudLjQ@xxxxxxxxxxxxxx>
Reply-to: tor-talk@xxxxxxxxxxxxxxxxxxxx
Sender: tor-talk-bounces@xxxxxxxxxxxxxxxxxxxx
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:9.0) Gecko/20111222 Thunderbird/9.0.1

On 01/04/12 07:40, Greg wrote:

Hi,
I searched google for people having problems accessing torproject.org
from Chrome on Windows, but I didn't see much besides a discussion on
December 21 about an outage
(http://comments.gmane.org/gmane.network.tor.general/2514).

I can access torproject.org from Firefox on my windows (server 2003)
machine, but not from Chrome. I get an "Invalid Server Certificate"
error and it doesn't let me continue.  Any ideas what might be wrong
with my Chrome/Windows setup?

I can reproduce it on WinXP/Chrome. This seems to be a bug in MicrosoftCryptoAPI (unless I am missing something).


So what's going on here (amazing case of "cooperation paradox"):

1. Firefox and Chrome on Windows see different chains. Specifically Chrome seesdifferent intermediate certificate for "DigiCert High Assurance CA-3" than thecertificate sent by www.torproject.org server.

2. Since www.torproject.org does not send DigiCert root CA cert in handshake,each browser builds yet another chain to root.

3. I've verified the chain seen by Chrome with gnutls, then looked at thecertificate differences by hand (checks out fine in both cases). I can't see whyMS CryptoAPI thinks the signature is invalid: it's not revoked and validityperiod, extensions, etc. seem fine as well.

Though it might be helpful if www.torproject.org sent whole chain (up toDigicert root).

If anyone wants to dig into it, three different chains are attached (one fromChrome 16.0.912.63 m/Win, two from Firefox 9.0.1/Linux - yes, it's possible toget two chains on different profiles).


Ondrej

_______________________________________________
tor-talk mailing list
tor-talk@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

Follow-Ups:
- Re: [tor-talk] "Invalid Server Certificate" accessing torproject.org on Chrome/Windows
  - From: Pascal

References:
- [tor-talk] "Invalid Server Certificate" accessing torproject.org on Chrome/Windows
  - From: Greg

Prev by Author: Re: [tor-talk] What is going on with /var/run/tor?
Next by Author: Re: [tor-talk] "Invalid Server Certificate" accessing torproject.org on Chrome/Windows
Previous by thread: [tor-talk] "Invalid Server Certificate" accessing torproject.org on Chrome/Windows
Next by thread: Re: [tor-talk] "Invalid Server Certificate" accessing torproject.org on Chrome/Windows
Index(es):
- Author
- Thread