Recently(more info) I've spotted a strange message in the logs on my quite recent, fresh installation of OS X Mavericks 10.9.2
Apr 27 15:26:47 Ivans-MacBook-Pro.local apsd[194]: Unrecognized leaf certificate
It appears every 15 minutes or so. I've googled it and there are many other users that pasted their logs(many times not even related with that issue) on net that had that message. It seems it is appearing for at least half a year now.
apsd is a constantly running Apple Push Notification service daemon
and it connects to one of the following servers on random:
1-courier.push.apple.com
2-courier.push.apple.com
3-courier.push.apple.com
4-courier.push.apple.com
.
.
.
200-courier.push.apple.com
on port 5223 (custom, but SSL)
every so often(to check for updates I guess)
Trying: https://1-courier.push.apple.com:5223 in the browser however shows that there is an issue related to the server certificate. Namely "This certificate is not valid(host name mismatch)". Which I suppose is because Apple did not create a certificate including a wildcard in the common name. However using Wireshark I see that the communication between apsd and Apple's server continues. I though, that can't possibly be right. Is apsd ignoring the validity check?!
I then tried to perform a man in the middle attack using a self signed certificate. And this is what I got in the logs:
Apr 27 15:42:07 Ivans-MacBook-Pro.local apsd[194]: CFNetwork SSLHandshake failed (-9807)
Apr 27 15:42:07 Ivans-MacBook-Pro.local apsd[194]: Failed to evaluate trust: No error. (0), result=5; retrying with revocation checking optional
Apr 27 15:42:07 Ivans-MacBook-Pro.local apsd[194]: failed to evaluate trust: No error. (0), result=5; retrying with system roots
Apr 27 15:42:07 Ivans-MacBook-Pro.local apsd[194]: Failed to evaluate trust: No error. (0), result=5
Apr 27 15:42:07 Ivans-MacBook-Pro.local apsd[194]: Untrusted peer, closing connection immediately
It's also worth noting that I've spotted(when observing the actual traffic with Wireshark) that the server requires the client to send his certificate. And apsd sends:
Subject Name
Common Name XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX (UUID)
Issuer Name
Country US
Organization Apple Inc.
Organization Unit Apple iPhone
Common Name Apple iPhone Device CA
.
.
.
It's strange that Mac OS X is sending what appears to be a public key presenting it self as iPhone? I do have Xcode installed, if it is somehow related to maybe having iPhone simulators installed. But I'm getting the mentioned log message all the times, regardless if Xcode is running or not. And evidently others are too, judging from the logs on the internet.
So what is going on?
How is apsd able to figure out my fake certificate and pass theirs?
Is something wrong here?
Note: My MitM implementation is quite simple, with DNS spoofing I give apsd a response that X-courier.push.apple.com is 127.0.0.1. I then listen with a self signed certificate that mimics Apple's server certificate(country, organization, common name...). BUT I did not implement requiring the client certificate from apsd. So I don't yet know if that is somehow related to my failed MitM. Could it be?
Are you guys there on Mac OS X getting the same log message in your Console(It appears in 'All messages' just when you launch it, but is actually in system.log), type 'leaf' in the search box...
UPDATE:
I've implemented requesting the client for its certificate. It's the same(SSLHandshake failure/Failed to evaluate trust). So apsd is checking something, I'm just not too sure it's implemented in the right way. Hopefully someone with far more experience will look into this...