0

My certificate provider responded to my CSR with four certificates, the first being "ours", and the remaining three presumably to build a chain of trust.

I've never had to investigate (and prove to my provider) a certificate chain at this level, so I'm open to being told I'm not looking at the proper information.

My certificate has

Issuer: C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Domain Validation Secure Server CA

with

X509v3 Authority Key Identifier: keyid:A6:C1:E7:E1:F4:F6:47:63:D7:2F:7D:8D:90:F8:BA:23:4F:60:AC:9E

What they sent me to build the chain are:

  1. Subject: C=US, O=Register.com, CN=Register.com CA SSL Services (DV)

    Issuer: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Hardware

    X509v3 Subject Key Identifier: 96:36:9B:F8:D6:E5:B3:68:4A:70:7A:7A:72:8D:D3:6E:2C:0B:B9:31

    X509v3 Authority Key Identifier: keyid:A1:72:5F:26:1B:28:98:43:95:5D:07:37:D5:85:96:9D:4B:D2:C3:45

  2. Subject: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Hardware

    Issuer: C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root

    X509v3 Subject Key Identifier: A1:72:5F:26:1B:28:98:43:95:5D:07:37:D5:85:96:9D:4B:D2:C3:45

    X509v3 Authority Key Identifier: keyid:AD:BD:98:7A:34:B4:26:F7:FA:C4:26:54:EF:03:BD:E0:24:CB:54:1A

  3. Subject: C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root

    Issuer: C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root

    X509v3 Subject Key Identifier: AD:BD:98:7A:34:B4:26:F7:FA:C4:26:54:EF:03:BD:E0:24:CB:54:1A

    X509v3 Authority Key Identifier: keyid:AD:BD:98:7A:34:B4:26:F7:FA:C4:26:54:EF:03:BD:E0:24:CB:54:1A

Since the AKID in my certificate is not an SKID in the chain they provided, my certificate fails to authenticate right away.... right?

5

Key identifiers are extensions meant to help with certificate path building, but a mismatch does not imply a validation failure (at least as far as X.509 / RFC 5280 is concerned -- what implementations do is another matter).

However, the subject/issuer DN must match in a valid chain, and a mismatch implies immediate rejection. If you have a certificate whose "issuer DN" is "C=US, ST=New Jersey,...", then the immediately preceding certificate in the chain (the certificate for that CA that issued your certificate) must have that exact name in its "subject DN". From what you tell, none of the certificates they sent you fulfils this property.

  • Thank you, Tom. I added the Issuer: fields from each of the certificates so we can see that the DN mine was issued from never matches a Subject DN. – tobinjim Oct 27 '14 at 18:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.