5

Setup

I am following this blog post to set up ASP.net MVC5 on Linux. When I get to the part that adds the Microsoft certificates, I am warned that they are invalid. For example, this command:

certmgr -ssl -m https://go.microsoft.com

returns the following:

Mono Certificate Manager - version 2.10.8.1
Manage X.509 certificates and CRL from stores.
Copyright 2002, 2003 Motus Technologies. Copyright 2004-2008 Novell. BSD licensed.


X.509 Certificate v3
Issued from: C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root
Issued to:   C=US, S=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT SSL SHA2
Valid from:  12/19/2013 8:07:32 PM
Valid until: 12/19/2017 8:06:55 PM
*** WARNING: Certificate signature is INVALID ***
Import this certificate into the CA store ?

I'm just doing this on a test box right now, so I went ahead and approved it. But, I have the hopes of going to production with this in the future. I have limited trust of Microsoft already and know they are a large target.

Questions

  1. Snarky: Is this a silly philosophical difference, just because the Linux community doesn't trust Microsoft?
  2. Is there a way I can view or inspect the certificate it's downloading, without having to use a browser?

From there I think I can Google enough stuff to figure out what the actual problem is. Two thoughts I have are:

  1. when I navigate to https://go.microsoft.com I'm redirected to http://www.microsoft.com so maybe it's retrieving a cert for the "wrong" Microsoft site.
  2. given that this is pulling in a Microsoft cert onto a Linux box, maybe it's an issue with \r\n versus \n in the cert.

migrated from security.stackexchange.com Apr 17 '15 at 12:19

This question came from our site for information security professionals.

  • I suspect the certificate is not self-signed. Do you have the root certificate on your machine? – M'vy Apr 17 '15 at 12:17
  • Certificates use a binary format, there's no line ending issue (and even if there was multiline text in there, it's an Internet format, line endings would be specified unambiguously). – Gilles Apr 17 '15 at 21:46
  • @M'vy I did not have the root certificate. Using the 1st line from Baazigar's answer below, I was able to retrieve the root cert, and then added it following this q&a. So now when I re-run certmgr -ssl -m https://go.microsoft.com I still get the invalid signature warning, but it's both in my root CA and by AddressBook store. The AddressBook store doesn't warn about it being invalid, the root CA does. – Damon Apr 20 '15 at 16:14
2

You need to use openssl for analyzing the certificate:

openssl s_client -showcerts -connect www.domain.com:443
openssl x509 -text -noout -in some.crt

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.