Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 0 down vote favorite

When I go to certain websites where it's important for me to know that I'm connected securely, certain browsers will say that the site failed the authenticity check. Firefox won't say anything, but even though Firefox is my favorite browser, I don't completely trust it lol.

I've been having a problem with security and hackers, so it's important that I can determine with a high degree of certainty whether or not the site is authentic, and why some browsers are saying it's not but Firefox says it is.

It appears that the site I'm connecting to has four certificates, and one of them was not signed by any trusted security authority.

How do I go about figuring this out, which tools do I use?

Edit: Here is the example that was asked for. As you can see, there are four certificates. The fourth one is the one that failed.

enter image description here

share|improve this question
1  
Can you post an example? Normally a web site has only one certificate. That being said, there could be a chain of one or more certificates from that server's certificate up to a trusted root SSL certificate. If your browser doesn't trust the root certificate, then you will get a warning. – HeatfanJohn Sep 23 '12 at 22:52

1 Answer

up vote 2 down vote accepted 
openssl s_client -CAfile /etc/ssl/certs/ca-certificates.crt -verify 12 -showcerts -connect mail.google.com:443

That will work on debian or its derivatives where the list of trusted CAs (of the system which may not be the same as Firefox's) is in /etc/ssl/certs/ca-certificates.crt. You may need to adapt on other Unices.

Note that it will not query revocation lists or OCSP servers.

You'll find that that fails on some bogus servers that don't provide with the full chain of intermediate certificates.

You can retrieve the certificates of the CAs trusted by firefox using certutil (from libnss3-tools package in Debian):

share|improve this answer
That seems to work, and for other sites as well, like google. But I tried it for www.wellsfargo.com and all I got was "verify depth is 12 CONNECTED(00000003)" What does that mean? – PROXY NINJA Sep 29 '12 at 8:43
1  
Try with the -tls1 or -ssl3 or -tls1_1 or -tls1_2 – Stephane Chazelas Sep 29 '12 at 8:51
All of those work except for -tls1_2. But for the rest, they all say that one of the certificates in the chain is a self-signed certificate, and it's flagged as an error. So now what? – PROXY NINJA Sep 29 '12 at 11:12
1  
It baffles me a bit. That server sends a chain with 4 certificates, the server's and 3 CAs one of which is self-signed. The self-signed one is not trusted by your system hence the error message. However, the chain seems to be invalid since the 1st CA certificate has not been signed by the 2nd. However, in my trusted certificate store, I do find a cert with the same subject as the 2nd that is the one that signed the 1st certificate. So it seems that if that server had only sent the two first certificates it would have appeared as trusted. Why openssl does't report the broken chain is unclear – Stephane Chazelas Sep 29 '12 at 14:53
1  
And BTW, firefox ignores the last two certificates sent by wellsfargo as it can verify that the 1st CA certificate is signed by the self-signed version of "VeriSign Class 3 Public Primary Certification Authority - G5" which it trusts – Stephane Chazelas Sep 29 '12 at 15:40
show 4 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.