Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

cupsd does not serve intermediate certificates with OpenSSL backend #465

Closed
chewi opened this issue Aug 28, 2022 · 2 comments
Closed

cupsd does not serve intermediate certificates with OpenSSL backend #465

chewi opened this issue Aug 28, 2022 · 2 comments
Assignees
@michaelrsweet
Labels
bug Something isn't working priority-high
Milestone
v2.4.3

Comments

@chewi
Copy link

chewi commented Aug 28, 2022

I use a Let's Encrypt certificate, served from /etc/cups/ssl. It was generated via Dehydrated. I have included it below. It works fine with the GnuTLS backend. With the OpenSSL backend, browsers like Vivaldi trust it, but curl and anything else that uses the system-wide Gentoo Linux ca-certificates package do not. This is because cupsd is not serving the intermediate (or root) certificate, only the leaf. I have seen this with 2.4.2 and the latest master at 4a6dcd7. Here is the output from openssl s_client -showcerts -connect.

CONNECTED(00000003)
depth=0 CN = *.aura-online.co.uk
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = *.aura-online.co.uk
verify error:num=21:unable to verify the first certificate
verify return:1
depth=0 CN = *.aura-online.co.uk
verify return:1
---
Certificate chain
 0 s:CN = *.aura-online.co.uk
   i:C = US, O = Let's Encrypt, CN = R3
-----BEGIN CERTIFICATE-----
MIIEkDCCA3igAwIBAgISA52q1vPCLWR4Dtn/4wtCIJjOMA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
EwJSMzAeFw0yMjA4MjgxNTIzMTlaFw0yMjExMjYxNTIzMThaMB4xHDAaBgNVBAMM
EyouYXVyYS1vbmxpbmUuY28udWswdjAQBgcqhkjOPQIBBgUrgQQAIgNiAATSoD1S
B+D9TKq0PgdH4X9ap/odqKyDFnMyRtTE1xPetMz4sAEiLj7vV5NdQPaw9fssWGsC
ykth8a1S+Vkd70pBInkc2F+C8Jd6YNX4wNJ3cBTgqXn/SA5WkF0KJma/LxWjggJg
MIICXDAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUF
BwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFOHPoMAAki4QkRO0r4EYyeiQ4F1h
MB8GA1UdIwQYMBaAFBQusxe3WFbLrlAJQOYfr52LFMLGMFUGCCsGAQUFBwEBBEkw
RzAhBggrBgEFBQcwAYYVaHR0cDovL3IzLm8ubGVuY3Iub3JnMCIGCCsGAQUFBzAC
hhZodHRwOi8vcjMuaS5sZW5jci5vcmcvMDEGA1UdEQQqMCiCEyouYXVyYS1vbmxp
bmUuY28udWuCEWF1cmEtb25saW5lLmNvLnVrMEwGA1UdIARFMEMwCAYGZ4EMAQIB
MDcGCysGAQQBgt8TAQEBMCgwJgYIKwYBBQUHAgEWGmh0dHA6Ly9jcHMubGV0c2Vu
Y3J5cHQub3JnMIIBAwYKKwYBBAHWeQIEAgSB9ASB8QDvAHUAb1N2rDHwMRnYmQCk
URX/dxUcEdkCwQApBo2yCJo32RMAAAGC5UPCSwAABAMARjBEAiAhSwnjzdD1s566
YAh84UoTgmZ3kgZKW7p42M+KibkQvgIgbChzGorae8/KNnf9exMKhbqN9Qemco3U
x131mK1rbiIAdgApeb7wnjk5IfBWc59jpXflvld9nGAK+PlNXSZcJV3HhAAAAYLl
Q8HnAAAEAwBHMEUCIHqrKaPNgkUhZ9LnE5+PUCNMe4aOW9jNh+KN+Vbwg3/hAiEA
lxfcV4GTrIHbxSIIS7flgwzHOq4c2E9+e28PSRD68RgwDQYJKoZIhvcNAQELBQAD
ggEBAD4XFlOnXfYTOqNseHSvmqf+bzaoBS3xfRcVhDh5MejBPIxAb4Di//QmyKBA
LOPqWXgTQl/BAOncfhH+dldJsM7r9kcB6tKCQEvnNX+mrj61TaaSLAH+CUnurEXh
azZPJzi6+DCBlUsXlkTn3qY03HFmgcUhuezxtOy/irli9ZkgKtLrq8hXVYGDPPgV
tD2YKbN2FBtN8/OkN9oAVvYcTpq5mhku/qy2gpOkE/HG3GhyfiPW5MVlQThytlKc
qV4CvpdDzFHtPU2jiAbAsBRa8Yn4Ua7T/0l2DZAlbgA65B6zcDgMSoGtc1YZGDCG
/AXNH2ne6Lqj7qQz4NoNKej+W9w=
-----END CERTIFICATE-----
---
Server certificate
subject=CN = *.aura-online.co.uk

issuer=C = US, O = Let's Encrypt, CN = R3

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: ECDSA
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 1644 bytes and written 420 bytes
Verification error: unable to verify the first certificate
---
New, TLSv1.2, Cipher is ECDHE-ECDSA-AES256-GCM-SHA384
Server public key is 384 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-ECDSA-AES256-GCM-SHA384
    Session-ID: 4B67F582F74F9C15E80F5398306E12F0603F277523F24F3FFD813049643F91E6
    Session-ID-ctx: 
    Master-Key: F329A4432D72A8AE5513A0A7B4D8BDB1F536681CD53811B14361A0E7AF41EB1CB08A5C8EA19CAD8B23BFD79F78B4CCFC
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 66 0a 26 c2 8a fa 36 cf-c7 a4 30 57 07 ec a1 d5   f.&...6...0W....
    0010 - 03 0d 02 b6 73 5f b9 0b-61 7f de 1c 6d 41 e7 6c   ....s_..a...mA.l
    0020 - e3 4e bf d5 25 7b 48 22-b5 7f 9f a3 87 b5 ac 3a   .N..%{H".......:
    0030 - 74 2c d3 7d d6 79 91 79-27 cb 4d 0c 69 6d b1 a0   t,.}.y.y'.M.im..
    0040 - cb dd 7b 25 da f5 32 6a-23 41 cd ea d7 55 a7 7c   ..{%..2j#A...U.|
    0050 - 34 7e 7b fc 4b 2f 8f e7-5d fb 19 85 f4 e2 57 a8   4~{.K/..].....W.
    0060 - cf 95 0d 85 88 3e b8 29-96 26 96 85 61 05 e0 97   .....>.).&..a...
    0070 - cf 79 ee 86 3b dd 85 8e-dc a5 13 e7 2b 26 e9 64   .y..;.......+&.d
    0080 - db a6 fc 14 e5 ad 07 8c-24 91 8f 21 4c 53 ae 0b   ........$..!LS..
    0090 - 41 82 6d f6 bb 49 83 b4-49 f3 1d 07 0c da d1 4a   A.m..I..I......J

    Start Time: 1661725708
    Timeout   : 7200 (sec)
    Verify return code: 21 (unable to verify the first certificate)
    Extended master secret: yes
---
DONE

Be aware that openssl s_client will make 2.4.2 segfault, but that issue has since been fixed.

Here is the full chain. I have tried removing the root certificate (which shouldn't be needed) and removing the blank lines, but it makes no difference.

-----BEGIN CERTIFICATE-----
MIIEkDCCA3igAwIBAgISA52q1vPCLWR4Dtn/4wtCIJjOMA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
EwJSMzAeFw0yMjA4MjgxNTIzMTlaFw0yMjExMjYxNTIzMThaMB4xHDAaBgNVBAMM
EyouYXVyYS1vbmxpbmUuY28udWswdjAQBgcqhkjOPQIBBgUrgQQAIgNiAATSoD1S
B+D9TKq0PgdH4X9ap/odqKyDFnMyRtTE1xPetMz4sAEiLj7vV5NdQPaw9fssWGsC
ykth8a1S+Vkd70pBInkc2F+C8Jd6YNX4wNJ3cBTgqXn/SA5WkF0KJma/LxWjggJg
MIICXDAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUF
BwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFOHPoMAAki4QkRO0r4EYyeiQ4F1h
MB8GA1UdIwQYMBaAFBQusxe3WFbLrlAJQOYfr52LFMLGMFUGCCsGAQUFBwEBBEkw
RzAhBggrBgEFBQcwAYYVaHR0cDovL3IzLm8ubGVuY3Iub3JnMCIGCCsGAQUFBzAC
hhZodHRwOi8vcjMuaS5sZW5jci5vcmcvMDEGA1UdEQQqMCiCEyouYXVyYS1vbmxp
bmUuY28udWuCEWF1cmEtb25saW5lLmNvLnVrMEwGA1UdIARFMEMwCAYGZ4EMAQIB
MDcGCysGAQQBgt8TAQEBMCgwJgYIKwYBBQUHAgEWGmh0dHA6Ly9jcHMubGV0c2Vu
Y3J5cHQub3JnMIIBAwYKKwYBBAHWeQIEAgSB9ASB8QDvAHUAb1N2rDHwMRnYmQCk
URX/dxUcEdkCwQApBo2yCJo32RMAAAGC5UPCSwAABAMARjBEAiAhSwnjzdD1s566
YAh84UoTgmZ3kgZKW7p42M+KibkQvgIgbChzGorae8/KNnf9exMKhbqN9Qemco3U
x131mK1rbiIAdgApeb7wnjk5IfBWc59jpXflvld9nGAK+PlNXSZcJV3HhAAAAYLl
Q8HnAAAEAwBHMEUCIHqrKaPNgkUhZ9LnE5+PUCNMe4aOW9jNh+KN+Vbwg3/hAiEA
lxfcV4GTrIHbxSIIS7flgwzHOq4c2E9+e28PSRD68RgwDQYJKoZIhvcNAQELBQAD
ggEBAD4XFlOnXfYTOqNseHSvmqf+bzaoBS3xfRcVhDh5MejBPIxAb4Di//QmyKBA
LOPqWXgTQl/BAOncfhH+dldJsM7r9kcB6tKCQEvnNX+mrj61TaaSLAH+CUnurEXh
azZPJzi6+DCBlUsXlkTn3qY03HFmgcUhuezxtOy/irli9ZkgKtLrq8hXVYGDPPgV
tD2YKbN2FBtN8/OkN9oAVvYcTpq5mhku/qy2gpOkE/HG3GhyfiPW5MVlQThytlKc
qV4CvpdDzFHtPU2jiAbAsBRa8Yn4Ua7T/0l2DZAlbgA65B6zcDgMSoGtc1YZGDCG
/AXNH2ne6Lqj7qQz4NoNKej+W9w=
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw
WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
RW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cP
R5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdx
sxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8Zutm
NHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxg
Z3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG
/kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC
AYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB
Af8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaA
FHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw
AoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw
Oi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB
gt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6W
PTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wl
ikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQz
CkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BIm
lJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4
avAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2
yJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1O
yK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90Ids
hCExroL1+7mryIkXPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+
HlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6Zv
MldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqX
nLRbwHOoq7hHwg==
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
MIIFYDCCBEigAwIBAgIQQAF3ITfU6UK47naqPGQKtzANBgkqhkiG9w0BAQsFADA/
MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
DkRTVCBSb290IENBIFgzMB4XDTIxMDEyMDE5MTQwM1oXDTI0MDkzMDE4MTQwM1ow
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwggIiMA0GCSqGSIb3DQEB
AQUAA4ICDwAwggIKAoICAQCt6CRz9BQ385ueK1coHIe+3LffOJCMbjzmV6B493XC
ov71am72AE8o295ohmxEk7axY/0UEmu/H9LqMZshftEzPLpI9d1537O4/xLxIZpL
wYqGcWlKZmZsj348cL+tKSIG8+TA5oCu4kuPt5l+lAOf00eXfJlII1PoOK5PCm+D
LtFJV4yAdLbaL9A4jXsDcCEbdfIwPPqPrt3aY6vrFk/CjhFLfs8L6P+1dy70sntK
4EwSJQxwjQMpoOFTJOwT2e4ZvxCzSow/iaNhUd6shweU9GNx7C7ib1uYgeGJXDR5
bHbvO5BieebbpJovJsXQEOEO3tkQjhb7t/eo98flAgeYjzYIlefiN5YNNnWe+w5y
sR2bvAP5SQXYgd0FtCrWQemsAXaVCg/Y39W9Eh81LygXbNKYwagJZHduRze6zqxZ
Xmidf3LWicUGQSk+WT7dJvUkyRGnWqNMQB9GoZm1pzpRboY7nn1ypxIFeFntPlF4
FQsDj43QLwWyPntKHEtzBRL8xurgUBN8Q5N0s8p0544fAQjQMNRbcTa0B7rBMDBc
SLeCO5imfWCKoqMpgsy6vYMEG6KDA0Gh1gXxG8K28Kh8hjtGqEgqiNx2mna/H2ql
PRmP6zjzZN7IKw0KKP/32+IVQtQi0Cdd4Xn+GOdwiK1O5tmLOsbdJ1Fu/7xk9TND
TwIDAQABo4IBRjCCAUIwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
SwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5pZGVudHJ1
c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTEp7Gkeyxx
+tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEB
ATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQu
b3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0LmNvbS9E
U1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFHm0WeZ7tuXkAXOACIjIGlj26Ztu
MA0GCSqGSIb3DQEBCwUAA4IBAQAKcwBslm7/DlLQrt2M51oGrS+o44+/yQoDFVDC
5WxCu2+b9LRPwkSICHXM6webFGJueN7sJ7o5XPWioW5WlHAQU7G75K/QosMrAdSW
9MUgNTP52GE24HGNtLi1qoJFlcDyqSMo59ahy2cI2qBDLKobkx/J3vWraV0T9VuG
WCLKTVXkcGdtwlfFRjlBz4pYg1htmf5X6DYO8A4jqv2Il9DjXA6USbW1FzXSLr9O
he8Y4IWS6wY7bCkjCWDcRQJMEhg76fsO3txE+FiYruq9RUWhiF1myv4Q6W+CyBFC
Dfvp7OOGAN6dEOM4+qR9sdjoSYKEBpsr6GtPAQw4dy753ec5
-----END CERTIFICATE-----
@michaelrsweet michaelrsweet self-assigned this Aug 29, 2022
@michaelrsweet michaelrsweet added bug Something isn't working priority-high labels Aug 29, 2022
@michaelrsweet michaelrsweet added this to the v2.4.x milestone Aug 29, 2022
@michaelrsweet
Copy link
Member

Investigating - this might explain some of the server-side failures I've been seeing with ChromeOS... :/

michaelrsweet added a commit that referenced this issue Sep 5, 2022
@michaelrsweet
The OpenSSL code path wasn't loading the full certificate chain (Issue …
cd84d7f 
…#465)
@michaelrsweet
Copy link
Member

Turns out this was a rather simple fix, caused by reusing older code from the CUPS 1.x days that never moved on:

[master cd84d7f] The OpenSSL code path wasn't loading the full certificate chain (Issue #465)

@michaelrsweet michaelrsweet modified the milestones: v2.4.x, v2.4.3 Sep 5, 2022
gentoo-bot pushed a commit to gentoo/gentoo that referenced this issue Sep 6, 2022
@thesamesam
net-print/cups: backpot fix for OpenSSL w/ intermediate certs
b667ed6 
Thanks to Chewi for pointing it out.

Bug: OpenPrinting/cups#465
Signed-off-by: Sam James <sam@gentoo.org>
negge pushed a commit to negge/gentoo that referenced this issue Sep 7, 2022
@thesamesam @negge
net-print/cups: backpot fix for OpenSSL w/ intermediate certs
3583e47 
Thanks to Chewi for pointing it out.

Bug: OpenPrinting/cups#465
Signed-off-by: Sam James <sam@gentoo.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@michaelrsweet michaelrsweet

Labels
bug Something isn't working priority-high
Projects
None yet
Milestone
v2.4.3
Development

No branches or pull requests
2 participants
@chewi @michaelrsweet