0

I'm having trouble making a secure connection to the IRC server at irc.pirateirc.net. gnutls doesn't recognise the SSL certificate issuer, even though the certificate is issued by a regular CA (Comodo).

I've tried using gnutls-cli on Debian 7 (Wheezy) and on Ubuntu 12.04 (Precise). The certificate fingerprint matches the one given on the pirateirc website:

SSL fingerprint (SHA1): 97:83:5C:F8:17:71:EC:00:0E:24:5B:47:10:62:9E:FE:F7:48:5A:15

Can anyone tell me what the problem is here?

See the log below:

$ gnutls-cli -p 6697 irc.pirateirc.net
Resolving 'irc.pirateirc.net'...
Connecting to '82.94.160.208:6697'...
- Successfully sent 0 certificate(s) to server.
- Ephemeral Diffie-Hellman parameters
 - Using prime: 2048 bits
 - Secret key: 2047 bits
 - Peer's public key: 2048 bits
- Server has requested a certificate.
- Certificate type: X.509
 - Got a certificate list of 5 certificates.
 - Certificate[0] info:
  - subject `OU=Domain Control Validated,OU=EssentialSSL Wildcard,CN=*.pirateirc.net', issuer `C=GB,ST=Greater Manchester,L=Salford,O=COMODO CA Limited,CN=EssentialSSL CA', RSA key 2048 bits, signed using RSA-SHA1, activated `2012-04-29 00:00:00 UTC', expires `2014-05-29 23:59:59 UTC', SHA-1 fingerprint `97835cf81771ec000e245b4710629efef7485a15'
 - Certificate[1] info:
  - subject `C=SE,O=AddTrust AB,OU=AddTrust External TTP Network,CN=AddTrust External CA Root', issuer `C=SE,O=AddTrust AB,OU=AddTrust External TTP Network,CN=AddTrust External CA Root', RSA key 2048 bits, signed using RSA-SHA1, activated `2000-05-30 10:48:38 UTC', expires `2020-05-30 10:48:38 UTC', SHA-1 fingerprint `02faf3e291435468607857694df5e45b68851868'
 - Certificate[2] info:
  - subject `C=US,ST=UT,L=Salt Lake City,O=The USERTRUST Network,OU=http://www.usertrust.com,CN=UTN-USERFirst-Hardware', issuer `C=SE,O=AddTrust AB,OU=AddTrust External TTP Network,CN=AddTrust External CA Root', RSA key 2048 bits, signed using RSA-SHA1, activated `2005-06-07 08:09:10 UTC', expires `2020-05-30 10:48:38 UTC', SHA-1 fingerprint `867539a26c81fa2d78277c3adfdb304312535e57'
 - Certificate[3] info:
  - subject `C=GB,ST=Greater Manchester,L=Salford,O=COMODO CA Limited,CN=COMODO Certification Authority', issuer `C=US,ST=UT,L=Salt Lake City,O=The USERTRUST Network,OU=http://www.usertrust.com,CN=UTN-USERFirst-Hardware', RSA key 2048 bits, signed using RSA-SHA1, activated `2006-12-01 00:00:00 UTC', expires `2020-05-30 10:48:38 UTC', SHA-1 fingerprint `3a6c6d0ce8015d1b3b5cae19952e06f9428c7993'
 - Certificate[4] info:
  - subject `C=GB,ST=Greater Manchester,L=Salford,O=COMODO CA Limited,CN=EssentialSSL CA', issuer `C=GB,ST=Greater Manchester,L=Salford,O=COMODO CA Limited,CN=COMODO Certification Authority', RSA key 2048 bits, signed using RSA-SHA1, activated `2006-12-01 00:00:00 UTC', expires `2019-12-31 23:59:59 UTC', SHA-1 fingerprint `23bc94154eef52fb485e90665f41c2be809b0667'
- The hostname in the certificate matches 'irc.pirateirc.net'.
- Peer's certificate issuer is unknown
- Peer's certificate is NOT trusted
- Version: TLS1.2
- Key Exchange: DHE-RSA
- Cipher: AES-256-CBC
- MAC: SHA256
- Compression: NULL
- Handshake was completed

- Simple Client Mode:

:amsterdam-nl.pirateirc.net NOTICE * :*** Looking up your hostname...
  • @Ramhound, no, he doesn't have a cert. – psusi May 22 '13 at 13:45
3

You might not have Commodo as trusted CA. Cert seems to be installed correctly:

http://www.sslshopper.com/ssl-checker.html#hostname=irc.pirateirc.net:6697

EDIT:

Just noticed, you don't process any CA certs! I'm not sure what you wanted to check with gnutls-utils. Validity of the cert?

Remember, SSL is based on trust. You have to trust someone (on this occasion Comodo CA) that certificate is valid.

try this to validate SSL:

gnutls-cli www.comodo.com

As expected, this will fail:

- Peer's certificate issuer is unknown
- Peer's certificate is NOT trusted
- Version: TLS 1.0
- Key Exchange: RSA
- Cipher: ARCFOUR 128
- MAC: SHA
- Compression: NULL
- Handshake was completed

Then:

wget --no-check-certificate "https://support.comodo.com/index.php?dload=Download&_m=downloads&_a=downloadfile&downloaditemid=87" -O /tmp/AddTrustExternalCARoot.crt

Now try the same check:

gnutls-cli --x509cafile /tmp/AddTrustExternalCARoot.crt www.comodo.com

You should see:

    Processed 1 CA certificate(s).
    Resolving 'www.comodo.com'...
    Connecting to '91.199.212.176:443'...
    - Certificate type: X.509
     - Got a certificate list of 3 certificates.

...

- Peer's certificate is trusted
- Version: TLS 1.0
- Key Exchange: RSA
- Cipher: ARCFOUR 128
- MAC: SHA
- Compression: NULL
- Handshake was completed
  • Hi, thanks for the update. I noticed that too, but there was actually another problem with the server configuration. – user226022 May 22 '13 at 14:27
  • Actually, what the issue appears to be is that the certificate chain is out of order (correct ordering is required by the TLS standard). GnuTLS enforces this rule, while OpenSSL doesn't. Points to Chris for pointing out that I hadn't actually loaded any certs, and also for the link to the supremely useful ssl-checker! – user226022 May 22 '13 at 14:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.