-3

As far as I know: when we make an ssl connection to a site we receive the site certificate, the browser check if the site certificate is in its list of root and trusted certification.

So if the CA is NOT in the browser trusted roots the connection should fail!

I made a connection to saba.bankmelli-iran.com, the site is verified by KEYNECTIS,

  1. I can find this CA as a valid root in firefox so I expect firefox connect to this site without any problem, and it does ! ( I find the certificates at preferences#advanced#view-certificates#Authorities menu)
  2. I can not find the KEYNECTIS in IE CA valid roots, I expect that IE does not trust this, but it goes and I get now Certification Warning. (I find the roots at internet_options#content#certificates#trusted_root_certification_authorities menu)

Why does IE trust this CA?

Here is a screenshot of IE Key store

enter image description here

  • what IE version? what's the cert warning? can you confirm the certificate path in IE? – schroeder Sep 27 '17 at 8:51
  • KEYNECTIS is not the root for me. The root is CertPlus. Can you confirm this? – schroeder Sep 27 '17 at 9:43
  • @schroeder yes this is CertPlus – Alireza Fattahi Sep 27 '17 at 10:19
  • Dear @JohnWu I see CLASS 2 KEYNECTIS CA is signed by CertPlus Class 2 Primay CA. Well, Let me ask this way, the saba.bankmelli-iran.com CA say that My root signer is CertPlus Class 2 Primay CA, Is it enough for a CA to be valid ... I think NO ! , how the browser knows that the CertPlus Class 2 Primay CA is a valid root ?! I guess the only way is that The CertPlus Class 2 Primay CA must be stored in windows key store.... please correct me if my assumption is wrong! – Alireza Fattahi Sep 27 '17 at 10:43
  • I think that you do not understand CAs – schroeder Sep 27 '17 at 11:04
2

You ran all of us into a wild chase.

Your screenshot shows Class 2 Primary CA in your Trusted Roots. This is the root CA for the site you linked.

KEYNECTIS is not the root of the site you linked, but is a CA signed by Class 2 Primary CA in your trusted root.

Nothing is wrong. Everything is working as intended.

http://certificate.fyicenter.com/340_Root_CA_Class_2_Primary_CA_Certplus_FR.html

  • The link finally helped me. I am very new in this topic, thanks for helping. For others which have same misunderstanding : when you open windows keystore tool, there are four columns for each certificate, the last one is Friendly Name which is not always same as Issued To. In my case I was looking for CertPlus Class 2 Primay CA (exact string) in the Issued To column, while I should looked at Friendly Name column. Thank you all for being patient :) – Alireza Fattahi Sep 27 '17 at 12:07
3

To expand on Stephan's answer:

CLASS 2 KEYNECTIS CA is signed by CertPlus Class 2 Primay CA.

CertPlus Class 2 Primay CA is in the root certificate store on Windows and FireFox.

  • Dear @paj28 I could not find the CertPlus Class 2 Primay CA in the key store and this is my problem. I have update my question and add a screen shoot of my key store Trusted Root Certification Authorities. I used this menu internet_options#content#certificates#trusted_root_certification_authorities – Alireza Fattahi Sep 27 '17 at 10:18
  • @AlirezaFattahi - Did you remove it? It's there by default (at least, it's there on my machine and I never manually installed it) – paj28 Sep 27 '17 at 10:34
  • Now you get my point :) Well I have not removed it at all !! At least if I have removed it I should get CA validation warning/error. But I am connection with no error. I am using IE 11 on Windows 10 – Alireza Fattahi Sep 27 '17 at 10:45
  • @AlirezaFattahi - Perhaps it is still there but not displaying for some reason. Is the CertPlus certificate in FireFox? Other possibility is you have some upstream SSL breaking proxy, but this would be visible in the certificate path of saba.bankmelli-iran.com. Perhaps include screenshots of those so people can see more clearly – paj28 Sep 27 '17 at 11:04
  • 1
    @paj28 see my answer - everything is working as intended – schroeder Sep 27 '17 at 11:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.