<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en" style='--code-editor-font: var(--default-mono-font, "GitLab Mono"), JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospace;'>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
<title>
GitLab
</title>
<style data-premailer="ignore" type="text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: .875rem;
}
body {
-webkit-text-shadow: rgba(255,255,255,.01) 0 0 1px;
}
body {
font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size: inherit;
}
</style>
</head>
<body style='font-size: inherit; -webkit-text-shadow: rgba(255,255,255,.01) 0 0 1px; font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";'>
<div class="content">
<p class="details" style="font-style: italic; color: #626168;">
<a href="https://gitlab.com/dulanshuangqiao">dulanshuangqiao</a> created an issue: <a href="https://gitlab.com/gnutls/gnutls/-/issues/1673">#1673</a>
</p>
<div class="md" style="position: relative; z-index: 1; color: #3a383f; word-wrap: break-word;">
<h2 dir="auto" style="margin-top: 0; margin-bottom: 1rem; border-bottom-style: solid; border-bottom-color: #dcdcde; font-weight: 600; font-size: 1.3125rem; letter-spacing: -0.01em; line-height: 1.25; color: #18171d; border-bottom-width: 1px; padding-bottom: 0.25rem;" align="initial">
<a href="#description-of-problem" aria-hidden="true" class="anchor" id="user-content-description-of-problem" style="margin-top: 0; float: left; margin-left: -20px; text-decoration: none; outline: none;"></a>Description of problem:</h2>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">GnuTLS accepted certificate with wrong value for Keyusage extension.WolfSSL believes that the key usage value of the certificate is wrong.</p>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">The key usage value is: cRLSign, keyAgreement, decipherOnly, nonRepudiation, dataEncipherment, keyCertSign (critical=True).</p>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">According to RFC5280 (section 4.2.1.3), the keyCertSign bit is asserted when the subject public key is used for verifying signatures on public key certificates. If the keyCertSign bit is asserted, then the cA bit in the basic constraints extension (Section 4.2.1.9) MUST also be asserted.</p>
<h2 dir="auto" style="margin-top: 1.5rem; margin-bottom: 1rem; border-bottom-style: solid; border-bottom-color: #dcdcde; font-weight: 600; font-size: 1.3125rem; letter-spacing: -0.01em; line-height: 1.25; color: #18171d; border-bottom-width: 1px; padding-bottom: 0.25rem;" align="initial">
<a href="#version-of-gnutls-used" aria-hidden="true" class="anchor" id="user-content-version-of-gnutls-used" style="margin-top: 0; float: left; margin-left: -20px; text-decoration: none; outline: none;"></a>Version of gnutls used:</h2>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">gnutls-cli 3.8.9</p>
<h2 dir="auto" style="margin-top: 1.5rem; margin-bottom: 1rem; border-bottom-style: solid; border-bottom-color: #dcdcde; font-weight: 600; font-size: 1.3125rem; letter-spacing: -0.01em; line-height: 1.25; color: #18171d; border-bottom-width: 1px; padding-bottom: 0.25rem;" align="initial">
<a href="#distributor-of-gnutls-eg-ubuntu-fedora-rhel" aria-hidden="true" class="anchor" id="user-content-distributor-of-gnutls-eg-ubuntu-fedora-rhel" style="margin-top: 0; float: left; margin-left: -20px; text-decoration: none; outline: none;"></a>Distributor of gnutls (e.g., Ubuntu, Fedora, RHEL)</h2>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">Ubuntu</p>
<h2 dir="auto" style="margin-top: 1.5rem; margin-bottom: 1rem; border-bottom-style: solid; border-bottom-color: #dcdcde; font-weight: 600; font-size: 1.3125rem; letter-spacing: -0.01em; line-height: 1.25; color: #18171d; border-bottom-width: 1px; padding-bottom: 0.25rem;" align="initial">
<a href="#how-reproducible" aria-hidden="true" class="anchor" id="user-content-how-reproducible" style="margin-top: 0; float: left; margin-left: -20px; text-decoration: none; outline: none;"></a>How reproducible:</h2>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">Steps to Reproduce:</p>
<ul dir="auto" style="text-align: initial; list-style-type: disc; margin: 0 0 1rem; padding: 0;">
<li style="margin-top: 0; line-height: 1.6em; margin-left: 25px; padding-left: 3px;">one certtool --verify --load-ca-certificate RootCA.pem --infile Cert17408145466.pem <a href="https://gitlab.com/-/project/179611/uploads/93373540eb7d0a1eeaf9438fae97d70f/Cert17408145466.pem" data-canonical-src="/uploads/93373540eb7d0a1eeaf9438fae97d70f/Cert17408145466.pem" data-link="true" class="gfm" style="margin-top: 0;">Cert17408145466.pem</a>
</li>
</ul>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial"><a href="https://gitlab.com/-/project/179611/uploads/15249761053afba0f63a86587f3db6e5/RootCA.pem" data-canonical-src="/uploads/15249761053afba0f63a86587f3db6e5/RootCA.pem" data-link="true" class="gfm" style="margin-top: 0;">RootCA.pem</a></p>
<h2 dir="auto" style="margin-top: 1.5rem; margin-bottom: 1rem; border-bottom-style: solid; border-bottom-color: #dcdcde; font-weight: 600; font-size: 1.3125rem; letter-spacing: -0.01em; line-height: 1.25; color: #18171d; border-bottom-width: 1px; padding-bottom: 0.25rem;" align="initial">
<a href="#actual-results" aria-hidden="true" class="anchor" id="user-content-actual-results" style="margin-top: 0; float: left; margin-left: -20px; text-decoration: none; outline: none;"></a>Actual results:</h2>
<div class="gl-relative markdown-code-block js-markdown-code">
<pre class="code highlight js-syntax-highlight language-plaintext" v-pre="true" style='display: block; font-size: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-radius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; margin: 0 0 1rem; padding: 12px; border: 1px solid #dcdcde;'><code style='font-size: inherit; color: inherit; word-wrap: normal; word-break: keep-all; border-radius: .25rem; background-color: inherit; white-space: pre; margin-top: 0; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset;'><span id="LC1" class="line" lang="plaintext" style="margin-top: 0;">Loaded CAs (1 available)</span>
<span id="LC2" class="line" lang="plaintext">Setting log level to 10</span>
<span id="LC3" class="line" lang="plaintext"> Subject: CN=www.mycompany1.com,OU=My Unit1,O=My Company1,L=MY Locality1,ST=My ST1,C=UN</span>
<span id="LC4" class="line" lang="plaintext"> Issuer: CN=www.mycompany.com,OU=My Unit1,O=My Company1,L=MY Locality1,ST=My ST1,C=UN</span>
<span id="LC5" class="line" lang="plaintext"> Checked against: CN=www.mycompany.com,OU=My Unit1,O=My Company1,L=MY Locality1,ST=My ST1,C=UN</span>
<span id="LC6" class="line" lang="plaintext"> Signature algorithm: RSA-SHA256</span>
<span id="LC7" class="line" lang="plaintext"> Output: Verified. The certificate is trusted. </span>
<span id="LC8" class="line" lang="plaintext">Chain verification output: Verified. The certificate is trusted.</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<h2 dir="auto" style="margin-top: 1.5rem; margin-bottom: 1rem; border-bottom-style: solid; border-bottom-color: #dcdcde; font-weight: 600; font-size: 1.3125rem; letter-spacing: -0.01em; line-height: 1.25; color: #18171d; border-bottom-width: 1px; padding-bottom: 0.25rem;" align="initial">
<a href="#expected-results" aria-hidden="true" class="anchor" id="user-content-expected-results" style="margin-top: 0; float: left; margin-left: -20px; text-decoration: none; outline: none;"></a>Expected results:</h2>
<p dir="auto" style="color: #3a383f; margin: 0;" align="initial">Not verified. The certificate is NOT trusted.
WolfSSL:wolfSSL_CertManagerVerify failed with return code -226 and error message Key Usage value error</p>
</div>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #626168;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/-/issues/1673">view it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://gitlab.com">gitlab.com</a>. <a href="https://gitlab.com/-/sent_notifications/650bf1f9afdeb330e716f94b9c73621d/unsubscribe" target="_blank" rel="noopener noreferrer">Unsubscribe</a> from this thread · <a href="https://gitlab.com/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link">Manage all notifications</a> · <a href="https://gitlab.com/help" target="_blank" rel="noopener noreferrer" class="help-link">Help</a>
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Issue","url":"https://gitlab.com/gnutls/gnutls/-/issues/1673"}}</script>
</p>
</div>
</body>
</html>