I have a web server, Debian, and the site uses a HTTPS cert from Thawte. The root certificate meant to be on top of my verification chain is also on the server, in /etc/ssl/certs, because the APT packet ca-certificates in installed (the actual content of the certificate list Debian uses there apparently comes from Mozilla).

Now I checked the same root certificate from 4 different locations:
a) The file in /etc/ssl/certs, coming from packet ca-certificates
b) The file contained in a fresh download of said APT packet, on a WIndows PC, just to look at the files
c) The root certificate downloaded from Thawtes website itself
d) The root certificate as used by my browser, Firefox, on Windows.

The problem is, only the debian-related ones (a and b) are the same, ie. I have three different certificates there. Name, fingerprint etc. are always the same, but the public key and some other values are completely different.

My question: Is this normal? Or do I have a huge reason to worry now?

I noticed that because I can't verify my site certificate on the server (SSH, with OpenSSL in the command line); OpenSSL isn't satisfied with the local CA files.

  • 4
    Since the public key is part of the certificate and the fingerprint is a hash of the full certificate it is impossible that the fingerprint is the same while the public key is different. – Steffen Ullrich Apr 6 '16 at 11:35
  • My first guess would be that the values are shown in different formats. – Tobi Nary Apr 6 '16 at 12:03
  • Do you use the same software to view certificates? Did you try to check them on the same machine (like, $ openssl x509 -fingerprint -pubkey -noout -in <cert_file>)? – Artem Bychkov Apr 6 '16 at 12:07
  • @Somebody0987: Could you post the certificates here or on a pastebin site? – StackzOfZtuff Apr 6 '16 at 14:16
  • Sorry, everyone, as said by SteffenUllrich this whole thing is impossible = nonsense. I'm certain now that there is no breach of my server or anything. The 3 causes were a) being a little bit braindead after searching the problem for 6h (and the actual situation involves PHP and Plesk too; a PHP upgrade triggered the problem in the first place because now file_get_content insists on correct certificates even locally) ...(continue below) – somebody0987 Apr 6 '16 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.