0

How do you actually know when a certificate is issued that your system doesn't recognize, whether to trust it or not? When I was setting up Outlook for Gmail I got prompted to install the following certificate which looks legitimate

screen shot

I guess I trust google, but one thing I never understood is why can't the certificate be spoofed and not actually be coming from Google?

Here is the prompt from Outlook 2013

install certificate?

Contents of exported certificate:

-----BEGIN CERTIFICATE-----
MIIEgDCCA2igAwIBAgIIS9Sb0M/irpgwDQYJKoZIhvcNAQELBQAwSTELMAkGA1UE
BhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2dsZSBJbnRl
cm5ldCBBdXRob3JpdHkgRzIwHhcNMTUxMTEyMTkwMzIzWhcNMTYwMjEwMDAwMDAw
WjBoMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwN
TW91bnRhaW4gVmlldzETMBEGA1UECgwKR29vZ2xlIEluYzEXMBUGA1UEAwwOc210
cC5nbWFpbC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC3ppZG
9jxYdfN51OCDbRbY5q4w5i8iQLWrbKONSE1iPiK1RB2Dqg01I1kat9MJyQ468iuN
t3mJSrG4O+gCVAnkhID3JnzQqbRlwuBJq8crv7nXDfhWy+m/V9WJdgAmX0EyBpi5
5z+MVjUWEyqqPcEqJy9ETr9flPSiDkCEYRxl++UaIRm/JhZaRjmbn6sWK4cs1qkn
bFzQffMoalMOnfmKDGHxzdgzD8ODdkV3QxVtiLG1joOpw2zzTVnPyu9wdkRazCqB
e/B1UYAZYxImb6O0F7wOLNCH4I0FVQ+z+5gCKoI2EsK4vxwegE3BFmHq5B8B6h3m
Q+60PYV21kk3aUvdAgMBAAGjggFLMIIBRzAdBgNVHSUEFjAUBggrBgEFBQcDAQYI
KwYBBQUHAwIwGQYDVR0RBBIwEIIOc210cC5nbWFpbC5jb20waAYIKwYBBQUHAQEE
XDBaMCsGCCsGAQUFBzAChh9odHRwOi8vcGtpLmdvb2dsZS5jb20vR0lBRzIuY3J0
MCsGCCsGAQUFBzABhh9odHRwOi8vY2xpZW50czEuZ29vZ2xlLmNvbS9vY3NwMB0G
A1UdDgQWBBSfeOyCPcmqprmS+YLrehM8K2VWjTAMBgNVHRMBAf8EAjAAMB8GA1Ud
IwQYMBaAFErdBhYbvPZotXb1gba7Yhq6WoEvMCEGA1UdIAQaMBgwDAYKKwYBBAHW
eQIFATAIBgZngQwBAgIwMAYDVR0fBCkwJzAloCOgIYYfaHR0cDovL3BraS5nb29n
bGUuY29tL0dJQUcyLmNybDANBgkqhkiG9w0BAQsFAAOCAQEAMXMXOrEPQnNdaVCG
M7AL6Vn988DDJkrcnKtrElFkITNeQWzMdeNH4AQs9r7z0KDvjZKEs8dbPZam1puN
oW4FvklUAa8jY8KhxmFok0jJnLhlsAG4HXWanoNz9n18tRcvtjUifnqTyIjPM2Iu
5ZulNvP/E4Gu+G0rAek78CqzFScOs0/Mkk4L8dFpWeAmUVFmC+HG2Gek0Pjl6ZAO
O4l7u4/2sNQHbstExnbCDnMBE/HdGcTlxJvLMCll2MArSOXWaq5Uwtahxt+CuV2R
jKWChefft/VOdek51MmXrJH3H8FjJkDcnnPsy6cft/w2mK24tXADPqmYpcF4tU4q
Pnox+A==
-----END CERTIFICATE-----
  • That prompting sounds suspicious. Can you add a screenshot that install-me prompt, please? – StackzOfZtuff Nov 19 '15 at 9:28
  • @StackzOfZtuff done – Celeritas Nov 19 '15 at 9:32
  • @StackzOfZtuff I'm connected through proxy – Celeritas Nov 19 '15 at 9:35
  • 1
    Okay. If can do this without disclosing anything that you want to remain hidden (internal hostname etc.) then I'd like to see a PEM dump of that certificate. (Click "View Certificate | Details | Copy to File..." and when it asks for "Export File Format" select "Base-64 encoded X.509 (.CER)".) – StackzOfZtuff Nov 19 '15 at 9:45
  • @StackzOfZtuff how can I get it to you? – Celeritas Nov 19 '15 at 9:53
2

Cert is fine.

Cert is fine. (It chains up to good root CA. I checked manually on Win10.)

This certificate is valid ONLY for smtp.gmail.com. (See below.) So if you access by ANY other DNS-Name or IP, then this is going to fail.

What name do you use? How is the proxy involved?

$ openssl x509 -in smtp.gmail.com.cer -noout -text

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5464163569050496664 (0x4bd49bd0cfe2ae98)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, O=Google Inc, CN=Google Internet Authority G2
        Validity
            Not Before: Nov 12 19:03:23 2015 GMT
            Not After : Feb 10 00:00:00 2016 GMT
        Subject: C=US, ST=California, L=Mountain View, O=Google Inc, CN=smtp.gmail.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:b7:a6:96:46:f6:3c:58:75:f3:79:d4:e0:83:6d:
                    16:d8:e6:ae:30:e6:2f:22:40:b5:ab:6c:a3:8d:48:
                    4d:62:3e:22:b5:44:1d:83:aa:0d:35:23:59:1a:b7:
                    d3:09:c9:0e:3a:f2:2b:8d:b7:79:89:4a:b1:b8:3b:
                    e8:02:54:09:e4:84:80:f7:26:7c:d0:a9:b4:65:c2:
                    e0:49:ab:c7:2b:bf:b9:d7:0d:f8:56:cb:e9:bf:57:
                    d5:89:76:00:26:5f:41:32:06:98:b9:e7:3f:8c:56:
                    35:16:13:2a:aa:3d:c1:2a:27:2f:44:4e:bf:5f:94:
                    f4:a2:0e:40:84:61:1c:65:fb:e5:1a:21:19:bf:26:
                    16:5a:46:39:9b:9f:ab:16:2b:87:2c:d6:a9:27:6c:
                    5c:d0:7d:f3:28:6a:53:0e:9d:f9:8a:0c:61:f1:cd:
                    d8:33:0f:c3:83:76:45:77:43:15:6d:88:b1:b5:8e:
                    83:a9:c3:6c:f3:4d:59:cf:ca:ef:70:76:44:5a:cc:
                    2a:81:7b:f0:75:51:80:19:63:12:26:6f:a3:b4:17:
                    bc:0e:2c:d0:87:e0:8d:05:55:0f:b3:fb:98:02:2a:
                    82:36:12:c2:b8:bf:1c:1e:80:4d:c1:16:61:ea:e4:
                    1f:01:ea:1d:e6:43:ee:b4:3d:85:76:d6:49:37:69:
                    4b:dd
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Alternative Name: 
                DNS:smtp.gmail.com
            Authority Information Access: 
                CA Issuers - URI:http://pki.google.com/GIAG2.crt
                OCSP - URI:http://clients1.google.com/ocsp

            X509v3 Subject Key Identifier: 
                9F:78:EC:82:3D:C9:AA:A6:B9:92:F9:82:EB:7A:13:3C:2B:65:56:8D
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Authority Key Identifier: 
                keyid:4A:DD:06:16:1B:BC:F6:68:B5:76:F5:81:B6:BB:62:1A:BA:5A:81:2F

            X509v3 Certificate Policies: 
                Policy: 1.3.6.1.4.1.11129.2.5.1
                Policy: 2.23.140.1.2.2

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://pki.google.com/GIAG2.crl

    Signature Algorithm: sha256WithRSAEncryption
         31:73:17:3a:b1:0f:42:73:5d:69:50:86:33:b0:0b:e9:59:fd:
         f3:c0:c3:26:4a:dc:9c:ab:6b:12:51:64:21:33:5e:41:6c:cc:
         75:e3:47:e0:04:2c:f6:be:f3:d0:a0:ef:8d:92:84:b3:c7:5b:
         3d:96:a6:d6:9b:8d:a1:6e:05:be:49:54:01:af:23:63:c2:a1:
         c6:61:68:93:48:c9:9c:b8:65:b0:01:b8:1d:75:9a:9e:83:73:
         f6:7d:7c:b5:17:2f:b6:35:22:7e:7a:93:c8:88:cf:33:62:2e:
         e5:9b:a5:36:f3:ff:13:81:ae:f8:6d:2b:01:e9:3b:f0:2a:b3:
         15:27:0e:b3:4f:cc:92:4e:0b:f1:d1:69:59:e0:26:51:51:66:
         0b:e1:c6:d8:67:a4:d0:f8:e5:e9:90:0e:3b:89:7b:bb:8f:f6:
         b0:d4:07:6e:cb:44:c6:76:c2:0e:73:01:13:f1:dd:19:c4:e5:
         c4:9b:cb:30:29:65:d8:c0:2b:48:e5:d6:6a:ae:54:c2:d6:a1:
         c6:df:82:b9:5d:91:8c:a5:82:85:e7:df:b7:f5:4e:75:e9:39:
         d4:c9:97:ac:91:f7:1f:c1:63:26:40:dc:9e:73:ec:cb:a7:1f:
         b7:fc:36:98:ad:b8:b5:70:03:3e:a9:98:a5:c1:78:b5:4e:2a:
         3e:7a:31:f8

(Side note: I didn't this certificate in the two useful certificate repositories that I like to use. Neither at ssl-tools.net. Nor at Crt.sh. But maybe it'll eventually find its way into those two useful repositories.)

No need to install it though.

You should not really have to install this manually. Otherwise something is wrong. It's correctly signed by a well known CA and should work out of the box on all modern operating systems.

1

Certificates bind together:

  • A domain name, server name or hostname
  • An organizational identity (i.e. company name) and location

That means an independent third party company which you and Google trust must carry out an assessment to ensure Google is Google and not another person/company pretending to be Google.

Your application has a list of trusted identity services companies and whenever you are presented a valid certificate issued with the "bless" of one of those companies, your system will not complain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.