Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #178575 > unrolled thread

certificate problem on sid

Back to article view | Back to linux.debian.user

Contents

  certificate problem on sid "SZ, Zsolt" <artifexor@gmail.com> - 2017-03-08 16:50 +0100
    Re: certificate problem on sid Nemeth Gyorgy <friczy@freemail.hu> - 2017-03-08 17:50 +0100
      Re: certificate problem on sid "SZ, Zsolt" <artifexor@gmail.com> - 2017-03-09 14:20 +0100
        Re: certificate problem on sid Nemeth Gyorgy <friczy@freemail.hu> - 2017-03-10 10:10 +0100

#178575 — certificate problem on sid

[Multipart message — attachments visible in raw view] — view raw

Hello,

I have a sid machine and yesterday after update and restart my system I get
invalid certificate for every secure page (web pages, git clone with https,
and so). I have not changed anything else just update and reboot.

As we have corporate proxy with NTLM authentication I am using CNTLM daemon
for authentication and using localhost as proxy. It was working fine until
yesterday. Any not secure traffic works fine though and local ssh is
working fine as well. Most likely my local proxy is the root of this
problem but I have not changed anything on its settings so I have no idea
what makes this bad behavior.

I tried with openssl s_client and it seems that beside the original
certificate the corporate certificate is face up somehow. As our root
certificate is only a local certificate, which is installed on Windows
machines, it is unknown for my debian system. I do not want to add to my
debian machine as my system worked without it before.

Any similar experience or idea what is wrong?

BR, Zsolt

[toc] | [next] | [standalone]

#178576

2017-03-08 16:45 keltezéssel, SZ, Zsolt írta:
> As we have corporate proxy with NTLM authentication I am using CNTLM
> daemon for authentication and using localhost as proxy. It was working
> fine until yesterday. Any not secure traffic works fine though and
> local ssh is working fine as well. Most likely my local proxy is the
> root of this problem but I have not changed anything on its settings
> so I have no idea what makes this bad behavior.
>
> I tried with openssl s_client and it seems that beside the original
> certificate the corporate certificate is face up somehow. As our root
> certificate is only a local certificate, which is installed on Windows
> machines, it is unknown for my debian system. I do not want to add to
> my debian machine as my system worked without it before.
>
> Any similar experience or idea what is wrong?
Contact your proxy administrator. If your local root certificate appears
in the certification chains then it is possible that the proxy checks
SSL traffic. Technically it is the same as a MITM traffic and it means
that your root certificate issues 'fake' certificates for the https
sites. If this is the case then the only solution is to add your local
root to the trusted certificates (or switch off SSL inspection on the
proxy but if it company policy then I see very little chance).

[toc] | [prev] | [next] | [standalone]

#178613

[Multipart message — attachments visible in raw view] — view raw

On Wed, Mar 8, 2017 at 5:43 PM, Nemeth Gyorgy <friczy@freemail.hu> wrote:

> 2017-03-08 16:45 keltezéssel, SZ, Zsolt írta:
> > As we have corporate proxy with NTLM authentication I am using CNTLM
> > daemon for authentication and using localhost as proxy. It was working
> > fine until yesterday. Any not secure traffic works fine though and
> > local ssh is working fine as well. Most likely my local proxy is the
> > root of this problem but I have not changed anything on its settings
> > so I have no idea what makes this bad behavior.
> >
> > I tried with openssl s_client and it seems that beside the original
> > certificate the corporate certificate is face up somehow. As our root
> > certificate is only a local certificate, which is installed on Windows
> > machines, it is unknown for my debian system. I do not want to add to
> > my debian machine as my system worked without it before.
> >
> > Any similar experience or idea what is wrong?
> Contact your proxy administrator. If your local root certificate appears
> in the certification chains then it is possible that the proxy checks
> SSL traffic. Technically it is the same as a MITM traffic and it means
> that your root certificate issues 'fake' certificates for the https
> sites. If this is the case then the only solution is to add your local
> root to the trusted certificates (or switch off SSL inspection on the
> proxy but if it company policy then I see very little chance).
>

Thanks for your answer György. About MITM. That is what I am afraid of.

I have asked proxy administrator before my email and they do not know such
settings. I can reach internet only through proxy so proxy is mandatory. Do
you have any URL how to "extract" my root certificate?

I was able to "extract" some certificates so I am able to connect to github
with git clone. I got some certificates from my Windows machine, probably
our root certification as well, and some from my Linux machine via openssl
s_client. I added crt base64 files to /usr/local/share/ca-certificates and
run update-ca-certificates application. Based on its output it seems that
certifications were successfully added. But at the same time I am still not
able to connect any https via Firefox and my dropbox is not able to connect
as well. So there is still some problem.

BR, Zsolt

[toc] | [prev] | [next] | [standalone]

#178637

On 2017-03-09 14:17, SZ, Zsolt wrote:
>
> Thanks for your answer György. About MITM. That is what I am afraid of.
>
> I have asked proxy administrator before my email and they do not know
> such settings. I can reach internet only through proxy so proxy is
> mandatory. Do you have any URL how to "extract" my root certificate?
>
> I was able to "extract" some certificates so I am able to connect to
> github with git clone. I got some certificates from my Windows
> machine, probably our root certification as well, and some from my
> Linux machine via openssl s_client. I added crt base64 files to
> /usr/local/share/ca-certificates and run update-ca-certificates
> application. Based on its output it seems that certifications were
> successfully added. But at the same time I am still not able to
> connect any https via Firefox and my dropbox is not able to connect as
> well. So there is still some problem.
Firefox uses its own certificate store regardless of ca-certificates
directory. So if you could add certificate to ca-certificates directory
successfully (e.g wget works well - it uses the system-wide
certificates) then you should add it to Firefox also.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web