1

We have built an application on Heroku.com for an enterprise customer, and when the customer reaches the site via their normal internal network, they get an SSL certificate warning in their browser, however if they use their guest WiFi network, they do not get the error, and anyone else reaching the site from a network outside the building does not get the error either.

The error is:

The certificate is only valid for the following names: *.herokuapp.com, herokuapp.com
Error code: SSL_ERROR_BAD_CERT_DOMAIN

While Heroku tech support has been responsive they have been unable to find the problem so I'm trying here.

When I run openssl on both the 'good' networks and the 'bad' networks, I get a different certificate for the '0' (first) cert in the chain, it's as if there are two certs or we've somehow misconfigured the certs, but we're unsure how they've been misconfigured, and why it would work at all if that was the case. Why would the client see a different cert chain just because they're on a different network?

Some people have said that this is caused by a certificate-rewriting proxy on the corporate network but the client has told me they don't do cert rewriting.

Diagnostics

The output of my diagnostic command:

openssl s_client -showcerts -servername foo.bar.com -connect foo.bar.com:443 

Bad network output

Here's the output on the 'bad' network (I've redacted specific data):

> CONNECTED(00000003) depth=1 /C=US/O=DigiCert
> Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
> verify error:num=20:unable to get local issuer certificate verify
> return:0
> --- Certificate chain  0 s:/C=US/ST=California/L=San Francisco/O=Heroku, Inc./CN=*.herokuapp.com    i:/C=US/O=DigiCert
> Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
> -----BEGIN CERTIFICATE----- xxxx
> -----END CERTIFICATE-----  1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA 
>   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High
> Assurance EV Root CA
> -----BEGIN CERTIFICATE----- xxxx
> -----END CERTIFICATE-----
> --- Server certificate subject=/C=US/ST=California/L=San Francisco/O=Heroku, Inc./CN=*.herokuapp.com issuer=/C=US/O=DigiCert
> Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
> --- No client certificate CA names sent
> --- SSL handshake has read 2745 bytes and written 458 bytes
> --- New, TLSv1/SSLv3, Cipher is AES128-SHA Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion:
> NONE SSL-Session:
>     Protocol  : TLSv1
>     Cipher    : AES128-SHA
>     Session-ID: xxx
>     Session-ID-ctx: 
>     Master-Key: xxx
>     Key-Arg   : None
>     Start Time: 1490624709
>     Timeout   : 300 (sec)
>     Verify return code: 0 (ok)
> --- DONE

Good network output

Here's the output on the 'good' network:

> CONNECTED(00000003) depth=1 /C=US/O=Symantec Corporation/OU=Symantec
> Trust Network/CN=Symantec Class 3 Secure Server CA - G4 verify
> error:num=20:unable to get local issuer certificate verify return:0
> --- Certificate chain  0 s:/C=US/ST=Maryland/L=xxx/O=xxx/OU=Headquarters/CN=foo.bar.com 
>   i:/C=US/O=Symantec Corporation/OU=Symantec Trust Network/CN=Symantec
> Class 3 Secure Server CA - G4
> -----BEGIN CERTIFICATE----- xxx
> -----END CERTIFICATE-----  1 s:/C=US/O=Symantec Corporation/OU=Symantec Trust Network/CN=Symantec Class 3 Secure
> Server CA - G4    i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust
> Network/OU=(c) 2006 VeriSign, Inc. - For authorized use
> only/CN=VeriSign Class 3 Public Primary Certification Authority - G5
> -----BEGIN CERTIFICATE----- xxx
> -----END CERTIFICATE-----
> --- Server certificate subject=/C=US/ST=xxx/L=xxx/O=xxx./OU=Headquarters/CN=foo.bar.com
> issuer=/C=US/O=Symantec Corporation/OU=Symantec Trust
> Network/CN=Symantec Class 3 Secure Server CA - G4
> --- No client certificate CA names sent
> --- SSL handshake has read 3069 bytes and written 458 bytes
> --- New, TLSv1/SSLv3, Cipher is AES256-SHA Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion:
> NONE SSL-Session:
>     Protocol  : TLSv1
>     Cipher    : AES256-SHA
>     Session-ID: xxx
>     Session-ID-ctx: 
>     Master-Key: xxx
>     Key-Arg   : None
>     Start Time: 1490624583
>     Timeout   : 300 (sec)
>     Verify return code: 0 (ok)
> --- DONE
  • 1
    It's not only a different certificate but also a different common cipher. Are you using the same openssl version for this tests? And can you check if you are both times use the same IP address to connect (might be IPv4 or IPv6!). One can see this for example from a packet capture. My assumption is that either DNS was recently changed and did not propagate yet to the bad site or that one site is using IPv4 while the other IPv6 and there are different setups. – Steffen Ullrich Mar 27 '17 at 15:56
  • 1
    Thanks Steffen. Yes, same version of openssl used for both tests. You've brought up a good question: worth noting here that on Heroku an app never gets a fixed IP address (I'm assuming that's because they use a virtualized infrastructure) and so perhaps it's that fact that is causing a problem. – bethesdaboys Mar 27 '17 at 16:12
  • 1
    what happens when you run host yourherokuapp.com – MikeSchem Mar 27 '17 at 19:44
  • btw, just as a security measure, I'd make sure not to transmit any sensitive information.. there is the chance that you are being attacked with a mitm attack – MikeSchem Mar 27 '17 at 19:49
  • Stale DNS maybe? What do the regular SSL-checkers report? (SSLPing, SSL Labs, HT Bridge) – StackzOfZtuff Apr 27 '17 at 6:57
1

This looks like you have a misconfigured or severely outdated proxy/router/firewall that is stripping SNI field in the bad network, that's why you received a generic *.herokuapp.com certificate when inside the bad network instead of your organization's certificate.

0

Apparently you have a wild card certificate *.herokuapp.com, so it is possible that the application is being served from a different host/domain.

You have to trace your packets , with something like wireshark to see where the TSL connection is being established.

Try this additional troubleshooting:

  1. Check your certificate chain(s) make sure that a root certificate is local. for example in windows you can view this information graphically.
  2. Assuming that the application is accessed trhough a browser Check if your customer has any customized version of (IE, FF, Chrome) , they may not have the complete Cert chain.
  3. Check if the application is actually being served from a public domain (herokuapp.com). sometime enterprise customers have (private access to their apps), mainly when using hybrid cloud.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.