<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en" style='--code-editor-font: var(--default-mono-font, "GitLab Mono"), JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospace;'>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
<title>
GitLab
</title>
<style data-premailer="ignore" type="text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: .875rem;
}
body {
-webkit-text-shadow: rgba(255,255,255,.01) 0 0 1px;
}
body {
font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size: inherit;
}
</style>
</head>
<body style='font-size: inherit; -webkit-text-shadow: rgba(255,255,255,.01) 0 0 1px; font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";'>
<div class="content">
<p class="details" style="font-style: italic; color: #626168;">
<a href="https://gitlab.com/segasai">Sergey Koposov</a> created an issue: <a href="https://gitlab.com/gnutls/gnutls/-/issues/1741">#1741</a>
</p>
<div class="md" style="position: relative; z-index: 1; color: #3a383f; word-wrap: break-word;">
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">Hi,</p>
<h2 dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">
<a href="#description-of-problem" aria-hidden="true" class="anchor" id="user-content-description-of-problem" style="margin-top: 0; margin-left: -20px; text-decoration: none; outline: none; position: absolute; width: 20px;"></a>Description of problem:</h2>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">The certificate with duplicates in the chain is rejected by gnutls (but is accepted by openssl and other libraries).</p>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">The issue arose when evolution email client started to complain about 'unacceptable tls certificate' when trying to authenticate for my email.</p>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">This lead me to investigate and run:</p>
<div class="gl-relative markdown-code-block js-markdown-code">
<pre class="code highlight js-syntax-highlight language-plaintext" v-pre="true" style='display: block; font-size: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-radius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; margin: 0 0 1rem; padding: 12px; border: 1px solid #dcdcde;'><code style='font-size: inherit; color: inherit; word-wrap: normal; word-break: keep-all; border-radius: .25rem; background-color: inherit; white-space: pre; margin-top: 0; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset;'><span id="LC1" class="line" lang="plaintext" style="margin-top: 0;">$ gnutls-cli edadfed.ed.ac.uk</span>
<span id="LC2" class="line" lang="plaintext">Processed 146 CA certificate(s).</span>
<span id="LC3" class="line" lang="plaintext">Resolving 'edadfed.ed.ac.uk:443'...</span>
<span id="LC4" class="line" lang="plaintext">Connecting to '129.215.67.169:443'...</span>
<span id="LC5" class="line" lang="plaintext">- Certificate type: X.509</span>
<span id="LC6" class="line" lang="plaintext">- Got a certificate list of 23 certificates.</span>
<span id="LC7" class="line" lang="plaintext">- Certificate[0] info:</span>
<span id="LC8" class="line" lang="plaintext"> - subject `CN=edadfed.ed.ac.uk,O=The University of Edinburgh,L=Edinburgh,C=GB', issuer `CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1,O=DigiCert Inc,C=US', serial 0x0d296cf890eebdccb272d452d54ff742, RSA key 2048 bits, signed using RSA-SHA256, activated `2025-08-20 00:00:00 UTC', expires `2026-08-19 23:59:59 UTC', pin-sha256="t6K+8+rkiqVzq9PrgQhq3zleQFNGA2zGshvNCwRcYI4="</span>
<span id="LC9" class="line" lang="plaintext"> Public Key ID:</span>
<span id="LC10" class="line" lang="plaintext"> sha1:bc67d663290cece53fccc2da4a8339c81140be98</span>
<span id="LC11" class="line" lang="plaintext"> sha256:b7a2bef3eae48aa573abd3eb81086adf395e405346036cc6b21bcd0b045c608e</span>
<span id="LC12" class="line" lang="plaintext"> Public Key PIN:</span>
<span id="LC13" class="line" lang="plaintext"> pin-sha256:t6K+8+rkiqVzq9PrgQhq3zleQFNGA2zGshvNCwRcYI4=</span>
<span id="LC14" class="line" lang="plaintext"></span>
<span id="LC15" class="line" lang="plaintext">- Certificate[1] info:</span>
<span id="LC16" class="line" lang="plaintext"> - subject `CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1,O=DigiCert Inc,C=US', issuer `CN=DigiCert Global Root G2,OU=www.digicert.com,O=DigiCert Inc,C=US', serial 0x0cf5bd062b5602f47ab8502c23ccf066, RSA key 2048 bits, signed using RSA-SHA256, activated `2021-03-30 00:00:00 UTC', expires `2031-03-29 23:59:59 UTC', pin-sha256="Wec45nQiFwKvHtuHxSAMGkt19k+uPSw9JlEkxhvYPHk="</span>
<span id="LC17" class="line" lang="plaintext">....</span>
<span id="LC18" class="line" lang="plaintext">- Certificate[21] info:</span>
<span id="LC19" class="line" lang="plaintext"> - subject `CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1,O=DigiCert Inc,C=US', issuer `CN=DigiCert Global Root G2,OU=www.digicert.com,O=DigiCert Inc,C=US', serial 0x0cf5bd062b5602f47ab8502c23ccf066, RSA key 2048 bits, signed using RSA-SHA256, activated `2021-03-30 00:00:00 UTC', expires `2031-03-29 23:59:59 UTC', pin-sha256="Wec45nQiFwKvHtuHxSAMGkt19k+uPSw9JlEkxhvYPHk="</span>
<span id="LC20" class="line" lang="plaintext">- Certificate[22] info:</span>
<span id="LC21" class="line" lang="plaintext"> - subject `CN=DigiCert Global Root G2,OU=www.digicert.com,O=DigiCert Inc,C=US', issuer `CN=DigiCert Global Root G2,OU=www.digicert.com,O=DigiCert Inc,C=US', serial 0x033af1e6a711a9a0bb2864b11d09fae5, RSA key 2048 bits, signed using RSA-SHA256, activated `2013-08-01 12:00:00 UTC', expires `2038-01-15 12:00:00 UTC', pin-sha256="i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY="</span>
<span id="LC22" class="line" lang="plaintext">- Could not verify certificate (err: Some constraint limits were reached.)</span>
<span id="LC23" class="line" lang="plaintext">*** PKI verification of server certificate failed...</span>
<span id="LC24" class="line" lang="plaintext">*** Fatal error: Error in the certificate.</span>
<span id="LC25" class="line" lang="plaintext"> </span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">It is my understanding the problem is that the same two certificates are repeated 11 times in the chain. It is clearly the problem on the server side, but openssl does not seem to have issues with it (and other clients either).</p>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">I have seen issue <a href="https://gitlab.com/gnutls/gnutls/-/issues/1335" data-reference-type="issue" data-original="#1335" data-link="false" data-link-reference="false" data-issue="104682028" data-project="179611" data-iid="1335" data-namespace-path="gnutls/gnutls" data-project-path="gnutls/gnutls" data-issue-type="issue" data-container="body" data-placement="top" title="verification error on duplicate server cert in chain" class="gfm gfm-issue" style="margin-top: 0;">#1335 (closed)</a> which seemed to me like it should have fixed the issue with certificate marked invalid if there are duplicates in the chain in 3.8.x branch, but it does not seem to be the case.</p>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">I am not really an ssl expert if it is really a bug on the gnutls side or it is just strict, but from a user standpoint it would be nice not to reject this certificate.</p>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">Also if I do --save-cert and certtool --verify it does not complain.</p>
<h2 dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">
<a href="#version-of-gnutls-used-383" aria-hidden="true" class="anchor" id="user-content-version-of-gnutls-used-383" style="margin-top: 0; margin-left: -20px; text-decoration: none; outline: none; position: absolute; width: 20px;"></a>Version of gnutls used: 3.8.3</h2>
<h2 dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">
<a href="#distributor-of-gnutls-eg-ubuntu-fedora-rhel-ubuntu" aria-hidden="true" class="anchor" id="user-content-distributor-of-gnutls-eg-ubuntu-fedora-rhel-ubuntu" style="margin-top: 0; margin-left: -20px; text-decoration: none; outline: none; position: absolute; width: 20px;"></a>Distributor of gnutls (e.g., Ubuntu, Fedora, RHEL): Ubuntu</h2>
<h2 dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">
<a href="#how-reproducible" aria-hidden="true" class="anchor" id="user-content-how-reproducible" style="margin-top: 0; margin-left: -20px; text-decoration: none; outline: none; position: absolute; width: 20px;"></a>How reproducible:</h2>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">Steps to Reproduce:</p>
<ul dir="auto" style="text-align: initial; list-style-type: disc; margin: 0 0 1rem; padding: 0;">
<li style="margin-top: 0; line-height: 1.6em; margin-left: 25px; padding-left: 3px;">$ gnutls-cli edadfed.ed.ac.uk</li>
</ul>
<h2 dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">
<a href="#actual-results" aria-hidden="true" class="anchor" id="user-content-actual-results" style="margin-top: 0; margin-left: -20px; text-decoration: none; outline: none; position: absolute; width: 20px;"></a>Actual results:</h2>
<ul dir="auto" style="text-align: initial; list-style-type: disc; margin: 0 0 1rem; padding: 0;">
<li style="margin-top: 0; line-height: 1.6em; margin-left: 25px; padding-left: 3px;">Could not verify certificate (err: Some constraint limits were reached.) *** PKI verification of server certificate failed... *** Fatal error: Error in the certificate.</li>
</ul>
<h2 dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">
<a href="#expected-results" aria-hidden="true" class="anchor" id="user-content-expected-results" style="margin-top: 0; margin-left: -20px; text-decoration: none; outline: none; position: absolute; width: 20px;"></a>Expected results:</h2>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">The certificate should be accepted</p>
<p dir="auto" style="color: #3a383f; margin: 0;" align="initial">Thank you</p>
</div>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #626168;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/-/issues/1741">view it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://gitlab.com">gitlab.com</a>. <a href="https://gitlab.com/-/sent_notifications/1-cj2h0agk2rkzjg0edz5xx1tjh/unsubscribe" target="_blank" rel="noopener noreferrer">Unsubscribe</a> from this thread · <a href="https://gitlab.com/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link">Manage all notifications</a> · <a href="https://gitlab.com/help" target="_blank" rel="noopener noreferrer" class="help-link">Help</a>
<span style="color: transparent; font-size: 0; display: none; overflow: hidden; opacity: 0; width: 0; height: 0; max-width: 0; max-height: 0;">
Notification message regarding https://gitlab.com/gnutls/gnutls/-/issues/1741 at 1758828053
</span>
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Issue","url":"https://gitlab.com/gnutls/gnutls/-/issues/1741"}}</script>
</p>
</div>
</body>
</html>