1

When I verify one of Firefox's certificates I get the following: dd

I know what CN and O is, but I don't know what C=IL is. Nor do I understand the error I get. Can somebody please tell me?

Thanks

1 Answer 1

3

C in a DN is country code, so C=IL is Country=Israel.

Error 18 means that the cert was badly generated, or is not configured properly on your host, so it's hard to diagnose that error message without more context. It found a self-signed root certificate (ie "0 depth"), but was not happy about it for whatever reason.

My immediate guess is that you need to add this root cert to your OS trust store. The OpenSSL Verify will try and chain the cert you provide back to a cert in your trust store. If it can't, then you'll get an error message like the one above.


EDIT addressing comments:

The OP exported a cert from Firefox's trust store and is attempting to verify it using openssl. The root cert that it chains to is not in the OS's trust store, so openssl is reporting: A) error: cannot establish trust in the root, but B) the cert is otherwise cryptographically valid.

19
  • 1
    AHH, that makes sense. Firefox keeps its own list of root certs that it trusts, independantly from the OS's trust store. OpenSSL does not have access to Firefox's trust list, so can't chain the cert back to something trustworthy. Oct 2, 2016 at 19:48
  • 1
    I didn't write openssl, so I don't know exactly what that ok is supposed to mean. Maybe it means that all the signatures are ok? Oct 2, 2016 at 19:51
  • 1
    man verify describes the verify operation. The important sections are VERIFY OPERATION and DIAGNOSTICS. In summary, the verify operation succeeds because of the following line: If a certificate is found which is its own issuer it is assumed to be the root CA.. (1) the errors pops out, which means that a root certificate could not be found, (2) the highlighted rule takes place and the processing continues, (3) verification succeeds as a CA certificate.
    – grochmal
    Oct 2, 2016 at 20:04
  • 1
    @user126233 It may or may not be a problem, depending on what you're trying to do. So what are you trying to do? Firefox trusts the cert, but your OS (and openssl) doesn't. End of story, don't worry about it. If this is a problem for you, then install ComSign's root cert into your OS (there are tons of articles on google for how to do this). Oct 2, 2016 at 22:13
  • 1
    @MikeOunsworth - Well, that may work on platforms where FF has control over how it is installed. I'm posting this from an FF that has not been built by the mozilla guys. I'm on arch where you can meddle with the FF certs. If you look at the FF package and the mozilla-certs they have no dependency on each other and you can use a FF with your own certs from the package manager :). You cannot force someone to use certain certs at application level.
    – grochmal
    Oct 2, 2016 at 22:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .