openssl – kana.me 要

クロス署名された証明書でエラー再びクロス署名と古いOpenSSL

早朝に一部のメールが滞留してたのでログを見たら。

Sep 30 23:06:30 metal postfix/smtp[61376]: 7224324829CA: Server certificate not trusted
Sep 30 23:06:31 metal postfix/smtp[61376]: 7224324829CA: to=, relay=x, delay=5.4, delays=0.71/0.09/4.6/0, dsn=4.7.5, status=deferred (Server certificate not trusted)

1 2	Sep 30 23:06:30 metal postfix/smtp[61376]: 7224324829CA: Server certificate not trusted Sep 30 23:06:31 metal postfix/smtp[61376]: 7224324829CA: to=, relay=x, delay=5.4, delays=0.71/0.09/4.6/0, dsn=4.7.5, status=deferred (Server certificate not trusted)

Let’s Encryptの証明書搭載のサーバなので、9月も終わりついにIdenTrustの… 続きを読むクロス署名された証明書でエラー再びクロス署名と古いOpenSSL

Notable Changes in NSS 3.27 CA certs. - Removal of 'Equifax Secure Certificate Authority'

某メールサーバ宛TLSでエラー発生

 postfix/smtp[28442]: ... delay=3866, delays=3865/0.04/0.31/0, dsn=4.7.5, status=deferred (Server certificate not trusted)
 postfix/smtp[28444]: certificate verification failed for ...:25: untrusted issuer /C=US/O=Equifax/OU=Equifax Secure Certificate Authority

1 2	postfix/smtp[28442]: ... delay=3866, delays=3865/0.04/0.31/0, dsn=4.7.5, status=deferred (Server certificate not trusted) postfix/smtp[28444]: certificate verification failed for ...:25: untrusted issuer /C=US/O=Equifax/OU=Equifax Secure Certificate Authority

確認してみます。

> /usr/local/bin/openssl s_client -showcerts -connect ...:25 -starttls smtp

CONNECTED(00000003)
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/OU=...
   i:/C=US/O=GeoTrust Inc./CN=RapidSSL SHA256 CA - G3
-----BEGIN CERTIFICATE-----

...

-----END CERTIFICATE-----
 1 s:/C=US/O=GeoTrust Inc./CN=RapidSSL SHA256 CA - G3
   i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
-----BEGIN CERTIFICATE-----
MIIEJTCCAw2gAwIBAgIDAjp3MA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVT

...

gP8L8mJMcCaY
-----END CERTIFICATE-----
 2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
   i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
-----BEGIN CERTIFICATE-----
MIIDfTCCAuagAwIBAgIDErvmMA0GCSqGSIb3DQEBBQUAME4xCzAJBgNVBAYTAlVT

...

b8ravHNjkOR/ez4iyz0H7V84dJzjA1BOoa+Y7mHyhD8S
-----END CERTIFICATE-----

> /usr/local/bin/openssl s_client -showcerts -connect ...:25 -starttls smtp

CONNECTED(00000003)

depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA

verify error:num=20:unable to get local issuer certificate

verify return:0

---

Certificate chain

0 s:/OU=...

i:/C=US/O=GeoTrust Inc./CN=RapidSSL SHA256 CA - G3

-----BEGIN CERTIFICATE-----

...

-----END CERTIFICATE-----

1 s:/C=US/O=GeoTrust Inc./CN=RapidSSL SHA256 CA - G3

i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA

-----BEGIN CERTIFICATE-----

MIIEJTCCAw2gAwIBAgIDAjp3MA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVT

...

gP8L8mJMcCaY

-----END CERTIFICATE-----

2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA

i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority

-----BEGIN CERTIFICATE-----

MIIDfTCCAuagAwIBAgIDErvmMA0GCSqGSIb3DQEBBQUAME4xCzAJBgNVBAYTAlVT

...

b8ravHNjkOR/ez4iyz0H7V84dJzjA1BOoa+Y7mHyhD8S

-----END CERTIFICATE-----

3つ送られた証明書の最後の証明書の… 続きを読む Notable Changes in NSS 3.27 CA certs. – Removal of ‘Equifax Secure Certificate Authority’

DNSSEC始めました

祝ルートからJPへのチェイン。弊社が利用しているドメイン(co.jp jp ch me es be dk com net org…)もすべてDNSSECおよびDANE/TLSA対応完了。DNSSECが有効でT… 続きを読む DNSSEC始めました

server does not support RFC 5746, see CVE-2009-3555 (was: potentially vulnerable to CVE-2009-3555) Apache HTTPD + OpenSSLでRFC5746リネゴシエーション対応

CVE-2011-0411 Plaintext command injection in STARTTLSはこちら Bug 549641の変更をここのタイトルにも入れてみました(2010/9/14) 。元々「潜在的に脆弱… 続きを読む server does not support RFC 5746, see CVE-2009-3555 (was: potentially vulnerable to CVE-2009-3555) Apache HTTPD + OpenSSLでRFC5746リネゴシエーション対応