Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

February 14, 2012 UTC:

Yesterday, I connected to a website of a VPN provider for which Firefox 8.0.1 on Windows 7 Ultimate x86-64 stated that its' SSL certificate is invalid. I saved the received certificate in a PEM file and e-mailed it to the site admins several hours later (they don't have a contact e-mail address, so I ended up e-mailing them through WhoisGuard). They suggested that I delete the certificate stored in Firefox. I did not try to reconnect prior to deleting the certificate, because I had an exception for it in Firefox. After deleting the certificate, Firefox did not consider the sites' certificate to be invalid upon subsequest connections. I saved the received SSL certificate in another PEM file and compared their checksums, which are the same.

The VPN provider in question is used by Anonymous Operations, who have recently DDoS-ed my countries' presidents' website, with his office making a statement that it will put an end to further attacks, and several other government websites. What do you think, is this a Firefox bug or might have there been a Government in the Middle attack?

February 18, 2012 UTC:

Today, I had the same warning with Firefox 10.0.1; the exact error is "sec_error_unknown_issuer". The certificate does not start at certificate root; it's not a self-signed certificate, either; it's a GlobeSSL certificate.

@Hubert Kario: This is the certificate from Firefox:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            12:e6:16:58:d3:fa:61:cf:a7:da:c5:84:e0:53:4d:ff
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=Globe Hosting, Inc., OU=GlobeSSL DV Certification Authority, CN=GlobeSSL CA
        Validity
            Not Before: Apr  5 00:00:00 2011 GMT
            Not After : Apr  5 23:59:59 2013 GMT
        Subject: OU=Domain Control Validated, OU=Provided by Globe Hosting, Inc., OU=Globe Standard SSL, CN=ibvpn.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:bd:c1:03:a1:95:88:48:93:29:8e:de:77:52:13:
                    64:e2:7a:e2:c8:9e:eb:fc:9b:6d:79:cd:c2:ce:ce:
                    1a:44:fc:fe:b1:a1:58:e2:bf:84:56:ef:d4:0c:0f:
                    5a:5f:c1:f5:aa:e7:01:86:f4:55:e6:51:60:2f:85:
                    5d:f6:5d:da:90:e8:be:ae:c7:87:5d:df:d1:88:c7:
                    1b:dc:d8:85:89:75:69:e9:a1:02:7b:94:4e:c4:b1:
                    b5:28:c3:48:6b:be:3f:a5:a4:bc:8f:72:bb:28:2a:
                    23:bc:d7:f9:ce:df:5f:8f:ab:5a:fd:4c:ef:16:90:
                    68:39:51:d8:cb:c3:78:ae:58:27:96:2b:cb:cf:b4:
                    6b:a2:0c:13:cd:8d:79:4f:42:ae:47:8c:c3:af:82:
                    45:67:65:73:25:f8:89:2d:cd:4c:b7:6b:b5:84:fa:
                    fd:0c:8d:b6:04:41:50:0d:a3:17:b4:da:b7:39:63:
                    d6:61:87:5f:42:47:2e:3b:42:a6:b3:16:2e:66:70:
                    6e:49:8d:3d:74:08:b2:be:5a:a6:90:87:b5:a9:f5:
                    2d:0a:a0:d6:fe:d3:29:5f:9f:72:94:fb:d3:a6:3f:
                    e5:a2:64:13:0b:2c:5f:80:cd:78:f3:1f:43:6f:2e:
                    63:3d:3e:08:47:ce:0a:4a:8a:e8:3e:f3:5a:ab:da:
                    0e:45
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier: 
                keyid:C3:AB:A0:02:F0:9B:F5:66:7F:28:15:92:22:95:DB:B8:4E:D3:93:08

            X509v3 Subject Key Identifier: 
                37:F8:27:7D:3A:EA:36:01:AF:DD:3A:80:46:EC:ED:C2:D7:A2:A8:38
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies: 
                Policy: 1.3.6.1.4.1.6449.1.2.2.27
                  CPS: http://www.globessl.com/docs/GlobeSSL_CPS.pdf

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.globessl.com/GlobeSSLDVCertificationAuthority.crl

            Authority Information Access: 
                CA Issuers - URI:http://crt.globessl.com/GlobeSSLDVCertificationAuthority.crt
                OCSP - URI:http://ocsp.globessl.com

            X509v3 Subject Alternative Name: 
                DNS:ibvpn.com, DNS:www.ibvpn.com
    Signature Algorithm: sha1WithRSAEncryption
        53:ab:f8:27:68:90:d7:71:0e:95:3d:21:71:9d:80:26:5f:bb:
        af:8e:f8:b1:bb:0b:a7:df:d4:80:39:00:96:d3:8e:8a:26:b7:
        65:c6:c0:c4:b9:6e:7b:f5:3f:28:f3:6a:5e:71:40:60:89:f3:
        ed:ae:c3:f4:7c:e9:c7:2f:b7:8e:ba:15:7f:48:3c:4c:02:3f:
        1f:36:15:a4:b4:2d:64:18:0d:63:a7:bb:63:e2:d4:52:63:33:
        03:42:dc:5c:28:65:d0:17:d3:d2:69:39:b8:66:32:b0:c7:2b:
        3d:cb:f3:f9:51:37:bb:50:c6:2f:3d:e6:45:c2:72:8a:95:98:
        14:6e:78:3b:61:23:7b:a8:f6:fe:6b:6d:a0:5e:95:a4:14:c6:
        b1:ba:a0:1a:0b:72:63:99:ee:fa:55:1f:f7:44:45:11:2d:d3:
        4a:94:df:21:f0:70:df:6d:71:bb:82:e2:a0:4c:c9:6e:0a:75:
        a8:6a:14:98:10:d1:cd:01:58:56:26:37:0e:41:de:54:15:80:
        68:92:e9:58:12:5f:cf:9b:36:c0:f9:28:a7:17:75:6f:ad:7c:
        62:fe:18:d1:df:c0:12:95:6f:c8:d3:08:a9:5f:f3:d7:93:e8:
        3a:a0:30:3c:72:4c:3f:e1:ac:ab:9e:3c:fa:90:37:55:6a:f4:
        91:c3:9c:0a
share|improve this question
1  
It is hard to say. You were not using the current version of Firefox. Do you know the reason Firefox thought the cert was invalid? You really should update Firefox. – Ramhound Feb 14 '12 at 16:48
I didn't pay attention to why Firefox though it was invalid, because I first assumed they're using a self-signed certificate, which I found out is not the case after seeing that it was signed by GlobeSSL. Well, assuming that there is a bug in Firefox, would this not happen to many people? I think that if there is such a bug in this version of Firefox, it would be widely known. – nlovric Feb 14 '12 at 16:55
Also, I cannot determine whether my traffic is passing through a CISCO-TAP-capable router at my providers', because ICMP ECHO is completely blocked by the provider. I would have to try to fingerprint all devices along the path. – nlovric Feb 14 '12 at 17:07
3  
@nlovric- Based on everything you don't know. You won't be able to get an answer to this question. – Ramhound Feb 15 '12 at 15:08
2  
The current version of Firefox is 10 not 8. Version 10 was release this month. Firefox does not run an update automatically, unlike Chrome which will check and notify you have to restart, Firefox will sit at your current version with the default settings. Instead of attacking something you don't understand, strive to understand it, as I said before based on everything you don't know its not possible to answer your question. – Ramhound Feb 16 '12 at 13:44
show 2 more comments

3 Answers

up vote 3 down vote accepted

The server is misconfigured. It is not serving the full certificate chain.

This issue is immediately identified by standard SSL server verification services. For example:

  • SSL Labs reports "Chain issues: Incomplete."

    enter image description here

  • GlobeSSL reports "Your certificate is not installed correctly. Make sure you have installed all necessary intermediate certificates(bundles)."

    enter image description here

P.S. It would have been easier for us to help you if you had provided the domain name or URL of the site you were visiting.

share|improve this answer
Well, I didn't want to reveal my browsing locations or make bad advertizing for them. Can you explain why Firefox complains only sometimes? – nlovric Feb 19 '12 at 5:43
@nlovric, I don't know. (Maybe there is some load-balancing, and only some of the front-end servers are misconfigured? Maybe there is some caching happening somewhere? Beats me.) The main point is that the site administrators have misconfigured their site and it is their responsibility to fix it; there's not much you can do until they fix their configuration. – D.W. Feb 19 '12 at 7:21
It has also occured to me that maybe they have two web servers. However, their DNS server keeps returning the same IP address; however, maybe there's NAT behind it. – nlovric Feb 19 '12 at 8:39
Your answer is the chosen answer, because it's not a "maybe", but a definite answer. I couldn't PM you to ask you whether I can award the bounty to the other guy, so I just gave it to him. – nlovric Feb 22 '12 at 19:32
I appreciate it, @nlovric. Hubert Kario deserves the bounty for his excellent, detailed, and rapid answer, so I'm glad that you awarded it to him. Good call! – D.W. Feb 23 '12 at 1:55
up vote 3 down vote
+100

The HTTP server may not be serving the intermediate certificates. Try using openssl s_client to verify what certificates do you get:

openssl s_client -connect www.google.com:443 -showcerts -CApath /etc/ssl/certs/

will print certificates between

-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----

You can then save those lines to a file, /tmp/a.pem in this example, and display it in human readable form using openssl x509:

openssl x509 -in /tmp/a.pem -inform PEM -noout -text

Repeat for all certificates in chain.

Update: This certificate was signed by GlobeSSL CA, so either your browser needs to have this intermediate CA or the server needs to send it to you. Opera (11.61) has this intermediate CA, Firefox doesn't.

The server is misconfigured and doesn't send the intermediate certificate. Here's the missing link between your certificate and a globally trusted CA (AddTrust External CA Root)

-----BEGIN CERTIFICATE-----

MIIE6DCCA9CgAwIBAgIQdIYhlpUQySkmKUvMi/gpLDANBgkqhkiG9w0BAQUFADBv
MQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFk
ZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBF
eHRlcm5hbCBDQSBSb290MB4XDTEwMDYyMjAwMDAwMFoXDTIwMDUzMDEwNDgzOFow
bzELMAkGA1UEBhMCVVMxHDAaBgNVBAoTE0dsb2JlIEhvc3RpbmcsIEluYy4xLDAq
BgNVBAsTI0dsb2JlU1NMIERWIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MRQwEgYD
VQQDEwtHbG9iZVNTTCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
AKBHBM6oNav/GGOIjsGJ+y0DD80tKJeh2tIQW4NPLEaYCxKY9LM5t5ejhl2AIgIz
yJ26m6y62Xx+3vejuSpp6Bd7/FYvmYfaKqJ3pKxWjKz1Ht84T5fSOgNq9knDKnuz
JlRMFeEA8wKQOKSZV9v9ipEB8XGWdd8h+RUZXRgrDnMQLQ5bVijL/WHstvBb+TwU
9kILys0X39l2X9ZUKUDReRX79UWpLW9UNddeOeamtQRbkNlvXC9YhQAA8GgRCBlA
UEmM2ofpgpnThq7UwTaiVg4Iw7c2epHwJAx5jzCl4kyZnX523ZiB6ElGrAHIJfd+
BMWe+g3i97hA8UX85sLJb8cCAwEAAaOCAX4wggF6MB8GA1UdIwQYMBaAFK29mHo0
tCb3+sQmVO8DveAky1QaMB0GA1UdDgQWBBTDq6AC8Jv1Zn8oFZIildu4TtOTCDAO
BgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAYBgNVHSAEETAPMA0G
CysGAQQBsjEBAgIbMEQGA1UdHwQ9MDswOaA3oDWGM2h0dHA6Ly9jcmwudXNlcnRy
dXN0LmNvbS9BZGRUcnVzdEV4dGVybmFsQ0FSb290LmNybDCBswYIKwYBBQUHAQEE
gaYwgaMwPwYIKwYBBQUHMAKGM2h0dHA6Ly9jcnQudXNlcnRydXN0LmNvbS9BZGRU
cnVzdEV4dGVybmFsQ0FSb290LnA3YzA5BggrBgEFBQcwAoYtaHR0cDovL2NydC51
c2VydHJ1c3QuY29tL0FkZFRydXN0VVROU0dDQ0EuY3J0MCUGCCsGAQUFBzABhhlo
dHRwOi8vb2NzcC51c2VydHJ1c3QuY29tMA0GCSqGSIb3DQEBBQUAA4IBAQBmnBNt
0n4s3WvWGpE3hYZRI01kY/Vegz6I/m9nhw7KhW27OzzVrfy6TbqLu8jB7SzUbcsQ
wjPj52aXjyvlj4GP7bzdh7Xb3CNfrg9AkSmeB9SxztCCG24d0aQIUBKujw95Z6cA
Z966kJtIvF+Qwxv+zLY6HtsVFbXeq3jjQaqTiuG/QxXsyWsh/u2h3+kLLcugcx/W
PviYm0Z45K0lIEGGKNDefRSWBEesyLlr3QDwRxGfi36xou1H6RcjNOa9i2dBZGAK
Gs11aYk5ZpXhModzkdCbg424x+C8Io8sJBPIwpSX+jEmIoIrte8FpqB+mgC0a+Oe
WUO8dpjzPDDbHDAu
-----END CERTIFICATE-----
share|improve this answer
I posted the textual representation of the certificate in my question; can you make something out of it? – nlovric Feb 18 '12 at 12:03
Yes, but this only happened twice. I've visited the site about 10 times, and this didn't happen. Therefore, Firefox does have the intermediate certificate. – nlovric Feb 18 '12 at 20:45
1  
@nlovric: Server has to return all certificates in chain excluding the top certificate, ergo: the server is misconfigured. – Hubert Kario Feb 18 '12 at 21:39
How can it be misconfigured only sometimes? Their DNS server returns only 1 IP address; however, maybe there's NAT behind it, even though they look like a small company to me. – nlovric Feb 19 '12 at 8:44
You get the bounty, since you have less reputation, and you both contributed almost equally. – nlovric Feb 22 '12 at 19:30
up vote 1 down vote

"What do you think, is this a Firefox bug or might have there been a Government in the Middle attack?"

It's a misconfiguration or oversight on the server. I get the same certificate when I visit the site from Canada. As confident as I am that Canada doesn't have a president, I'm confident that there is no man in the middle being performed through the SSL cert.

Hubert is probably right, there's a missing intermediate certificate. BTW, Chrome likes their cert, but doesn't like how they use it.

enter image description here

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.