Context: I've got some C++ code that uses curl with GnuTLS that's failing to connect to https://googleapis.com since Ubuntu updated the
ca-certificates package. That, as far as I can tell, corresponds to Debian bug #858064.
That's not (yet) the interesting part, though. Note, in particular, that this C++ code has been working fine for several years, and works if I provide it with the previous version of the
Problem: When I use the following commands:
$ openssl s_client -connect sheets.googleapis.com:443 \ -CApath /etc/ssl/certs/ca-certificates.crt $ gnutls-cli sheets.googleapis.com --x509cafile /etc/ssl/certs/ca-certificates.crt $ curl --cacert /etc/ssl/certs/ca-certificates.crt \ https://sheets.googleapis.com
...they all work correctly. As do Google Chrome and Mozilla Firefox.
And I can't figure out why they work, when my C++ code doesn't. It fails with
CURLE_SSL_CACERT (60): Peer certificate cannot be authenticated with known CA certificates.
Google's server returns the following certificate chain, according to OpenSSL; the GnuTLS one looks the same, as far as I can tell; and I see 3 certificates in Wireshark:
Certificate chain 0 s:/C=US/ST=California/L=Mountain View/O=Google Inc/CN=*.googleapis.com i:/C=US/O=Google Inc/CN=Google Internet Authority G2 1 s:/C=US/O=Google Inc/CN=Google Internet Authority G2 i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA 2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
Question: I'm trying to understand how GnuTLS, in particular, builds and verifies its certificate chain on Linux. That "Equifax Secure Certificate Authority" certificate appears to have been removed in the
ca-certificates update, and yet it doesn't appear to have broken anything (except my code).
If I look at the certificate in Google Chrome, that root certificate isn't shown, and the chain terminates at the "GeoTrust Global CA" certificate instead, which looks to be self-signed.
- Why is OpenSSL showing different results from Chrome?
- Why is OpenSSL (apparently) still trusting a removed CA certificate?
- How do I check that the certificates shown by OpenSSL/GnuTLS/etc. map to the relevant files in