In my previous post about OCA, the comments thread has a long discussion started by Shannon J Hager about Mozilla’s behavior when you attempt to access https://winqual.microsoft.com. If you attempt to access this web site using Firefox (or other Mozilla variants), you get the following dialog box:
Which is weird, because of course the web site works just fine in IE. No big deal, right – Microsoft’s well known for sleazing the rules for it’s own products, so obviously this is Microsoft’s fault – they probably did something like hard coding in trust to the Microsoft issuing CA. But I was kinda surprised at this, so I spent a bit of time checking it out...
The way that SSL certificate verification is supposed to work is that if the issuer of a certificate isn’t trusted, then the code validating the certificate is supposed to check the parent of the issuer to see if IT is trusted. If the parent of the issuer isn’t trusted, it’s supposed to check the grandparent of the issuer, and so forth until you find the root certificate authority (CA).
The issuing CA of the certificate on the winqual web site is the “Microsoft Secure Server Authority”, it’s not surprising Mozilla doesn’t trust that one. The parent of the issuing CA is the “Microsoft Internet Authority”, again, no surprise that Mozilla doesn’t trust it.
But the grandparent of the issuing CA is the “GTE CyberTrust Root”. This is a well known CA, and Mozilla should be trusting it. And what do you know, Mozilla DOES claim to trust that root CA:
Well, Cesar Eduardo Barros actually went and checked using openssl to see why the CA isn’t trusted. He tried:
$ openssl s_client -connect winqual.microsoft.com:443 -showcertsdepth=0 /C=US/ST=Washington/L=Redmond/O=WHDC (Old WHQL)/OU=Microsoft/CN=winqual.microsoft.comverify error:num=20:unable to get local issuer certificateverify return:1depth=0 /C=US/ST=Washington/L=Redmond/O=WHDC (Old WHQL)/OU=Microsoft/CN=winqual.microsoft.comverify error:num=27:certificate not trustedverify return:1depth=0 /C=US/ST=Washington/L=Redmond/O=WHDC (Old WHQL)/OU=Microsoft/CN=winqual.microsoft.comverify error:num=21:unable to verify the first certificateverify return:1CONNECTED(00000003)---Certificate chain0 s:/C=US/ST=Washington/L=Redmond/O=WHDC (Old WHQL)/OU=Microsoft/CN=winqual.microsoft.comi:/DC=com/DC=microsoft/DC=corp/DC=redmond/CN=Microsoft Secure Server Authority-----BEGIN CERTIFICATE-----[...]-----END CERTIFICATE--------Server certificatesubject=/C=US/ST=Washington/L=Redmond/O=WHDC (Old WHQL)/OU=Microsoft/CN=winqual.microsoft.comissuer=/DC=com/DC=microsoft/DC=corp/DC=redmond/CN=Microsoft Secure Server Authority---No client certificate CA names sent---SSL handshake has read 1444 bytes and written 324 bytes---New, TLSv1/SSLv3, Cipher is RC4-MD5Server public key is 1024 bitSSL-Session:Protocol : TLSv1Cipher : RC4-MD5Session-ID: [...]Session-ID-ctx:Master-Key: [...]Key-Arg : NoneStart Time: [...]Timeout : 300 (sec)Verify return code: 21 (unable to verify the first certificate)---DONE
Decoding the certificate it gave me above (openssl x509 -text) I get the same information Mozilla gives me and a bit more, but no copy of the issuer. The only suspicious thing in there is:Authority Information Access:CA Issuers - URI:http://www.microsoft.com/pki/mscorp/msssa1(1).crtCA Issuers - URI:http://corppki/aia/msssa1(1).crtGetting that URI gives me a blank HTML page with a 0.1 second redirect to itself. (The CRL one seems valid, however.)
So I was confused, why wasn’t openSSL able to verify the certificate? So I started asking the security PM’s here at Microsoft what was up. One of the things he told me was that Microsoft doesn’t hard code ANY intermediate certificates in our browser. Instead, our browser relies on the referral information in the certificate to chase down the CA hierarchy.
So why can’t Mozilla do the same thing? Is there something wrong with our certificates that’s preventing this from working? I kept on pestering and the PM’s kept on digging. Eventually I got email from someone indicating “IE is chasing 48.2 AIA”.
Well, this isn’t very helpful to me, so I asked the security PM in question to explain it in English. Apparently the root cause of the problem is that IE is following the Authority Information Access 48.2 OID (220.127.116.11.18.104.22.168.2) to find the parent of the certificate, while Mozilla isn’t.
Inside the Microsoft certificate is the following:
And if you go to http://www.microsoft.com/pki/mscorp/msssa1(1).crt you’ll find the parent CA for the certificate on the winqual web site. So now it’s off to figure out if the IE behavior is according to standard, or if it’s another case of Microsoft ignoring web standards in favor of proprietary extensions.
A few minutes of googling discovers that the AIA 48.2 field is also known as the id-ad-caIssuers OID. The authoritative reference for this OID is RFC2459 (the RFC that defines the x.509 certificate infrastructure). It describes this field as:
The id-ad-caIssuers OID is used when the additional information lists CAs that have issued certificates superior to the CA that issued the certificate containing this extension. The referenced CA Issuers description is intended to aid certificate users in the selection of a certification path that terminates at a point trusted by the certificate user.
In other words, IE is correctly chasing the AIA 48.2 references in the certificate to find the root issuing CA of the certificate. Since it didn’t have direct knowledge of the issuing CA, it correctly looked at the AIA 48.2 field of the certificate for the winqual web site and chased the AIA 48.2 references to the root CA. It appears that Mozilla (and OpenSSL and GnuSSL) apparently don’t follow this link, which is why they pop up the untrusted certificate dialog.
Issue solved. Now all someone has to do is to file bugs against Mozilla and OpenSSL to get them to fix their certificate validation logicJ.
Btw, I want to give HUGE kudo’s to Cesar Eduardo Barros for tirelessly trying to figure this out, and to Michael Howard and the lead program manager for NT security for helping me figure this out. If you look at the info from the certificate that Cesar posted above, he correctly caught the AIA 48.2 fields inside the CA, it was a huge step in the right direction, all that remained was to figure out what it really meant.
Edit: Fixed picture links.
Edit2: Fixed line wrapping of reference from RFC2459.