mutt fails on non-linear certificate chains
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
mutt (Ubuntu) |
Confirmed
|
Undecided
|
Unassigned |
Bug Description
mutt 1.13.2 fails on non-linear certificate chains when the CA that issued the server shipped intermediate CA has expired but an intermediate (non expired one) is present within the certificate store.
Expected behaviour:
- mutt accepts this connection without a certificate warning and asks for username and password
Behaviour is fixed in mutt 1.14.2.
Way to reproduce:
mutt -f imaps:/
the following message appears within mutt:
###
This certificate belongs to:
COMODO RSA Certification Authority
COMODO CA Limited
Salford Greater Manchester GB
This certificate was issued by:
AddTrust External CA Root
AddTrust AB
AddTrust External TTP Network
SE
This certificate is valid
from Tue, 30 May 2000 10:48:38 UTC
to Sat, 30 May 2020 10:48:38 UTC
SHA1 Fingerprint: F5AD 0BCC 1AD5 6CD1 5072 5B1C 866C 30AD 92EF 21B0
SHA256 Fingerprint: 4F32 D5DC 00F7 1525 0ABC C486 511E 37F5
WARNING: Server certificate has expired
###
as the server is shipping an intermediate CA issued by an expired CA (AddTrust External CA Root).
OpenSSL validates this connection just fine as "COMODO RSA Certification Authority" is included within the system's certificate store.
openssl s_client -connect mail.manitu.de:993
###
003)
depth=2 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Certification Authority
verify return:1
depth=1 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Domain Validation Secure Server CA
verify return:1
depth=0 OU = Domain Control Validated, CN = *.manitu.de
verify return:1
---
Certificate chain
0 s:OU = Domain Control Validated, CN = *.manitu.de
i:C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Domain Validation Secure Server CA
-----BEGIN CERTIFICATE-----
MIIHqzCCBpOgAwI
kDELMAkGA1UEBhM
A1UEBxMHU2FsZm9
BAMTLUNPTU9ETyB
QTAeFw0xODA1Mjk
bWFpbiBDb250cm9
MA0GCSqGSIb3DQE
WK9xJFh8dIjFZE3
92wz37I54ngYd8V
xefEbb/
h0d+bRpxFeOkSaP
Omp9+dSD+
vg7Yp91eg1MDqNq
1LFZpYxxl0CynnI
iX8aNGCY8hQzK/
kk4X6tf2vME2PYZ
8ABl8SGdJvnKrRo
+sNLDAUpWvt/
6hJWc99DtDoo2uc
DwEB/wQEAwIFoDA
BgEFBQcDAjBPBgN
HWh0dHBzOi8vc2V
TTBLMEmgR6BFhkN
aW5WYWxpZGF0aW9
TwYIKwYBBQUHMAK
bWFpblZhbGlkYXR
dHA6Ly9vY3NwLmN
bWFuaXR1LmRlMII
aR+r4Z5mow9+
eEdmvW8Hu8kWg0E
3odsBi3yDr4jEMc
AWOrI3TtAAAEAwB
3QIhAMwGvgjQ6eL
6gubVzxT8MDkOHh
LsC1bnETQEdJik1
Os37kJkFVZi8v3U
kdYXR1ZE1BsAYg7
F9xrszLnVviA6jZ
SutvmmSnIAHipUt
iQ4MBTMO3QRVQeD
VGfEvi1voQF4iAl
-----END CERTIFICATE-----
1 s:C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Domain Validation Secure Server CA
i:C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Certification Authority
-----BEGIN CERTIFICATE-----
MIIGCDCCA/
hTELMAkGA1UEBhM
A1UEBxMHU2FsZm9
BAMTIkNPTU9ETyB
MDAwMDAwWhcNMjk
EkdyZWF0ZXIgTWF
Q09NT0RPIENBIEx
bGlkYXRpb24gU2V
ADCCAQoCggEBAI7
bXcDow+
Qa4Al/e+
ytHNe+nEKpooIZF
UHg+TLAchhP6a5i
c13cRTCAquOyQQu
MBaAFLuvfgI9+
30O0Oija5zAOBgN
HSUEFjAUBggrBgE
BmeBDAECATBMBgN
bS9DT01PRE9SU0F
AQRlMGMwOwYIKwY
T1JTQUFkZFRydXN
ZG9jYS5jb20wDQY
mj6q1WZmAT7qSea
e+FE6kKVxF0NAVB
P0/HEZrIqPW1N+
dVEVABt0iN3hxzg
2bXhc3js9iPc0d1
V/Iz2tDIY+
HyaPs9Kg4DdbKDs
j4rBYKEMrltDR5F
0fxQ8ANAe4hZ7Q7
lBlGGSW4gNfL1IY
+AZxAeKCINT+b72x
-----END CERTIFICATE-----
2 s:C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Certification Authority
i:C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN = AddTrust External CA Root
-----BEGIN CERTIFICATE-----
MIIFdDCCBFygAwI
MQswCQYDVQQGEwJ
ZFRydXN0IEV4dGV
eHRlcm5hbCBDQSB
gYUxCzAJBgNVBAY
BgNVBAcTB1NhbGZ
VQQDEyJDT01PRE8
hkiG9w0BAQEFAAO
AHG8U9/
2RRr55yzhaCCena
ayzT7Y+
4Q08RWD8MpZRJ7x
m1y9TBsoilwie7S
vOldxJuvRZnio1o
8dm74YlguIwoVqw
IlKVgJNp6I5MZfG
KJwGRXa/
GHFrK+ymircxXDp
s1Hap0flhFMCAwE
JMtUGjAdBgNVHQ4
AgGGMA8GA1UdEwE
MDswOaA3oDWGM2h
bmFsQ0FSb290LmN
Ly9vY3NwLnVzZXJ
zbihKVcN6Fr30ek
Jw5dhHk3QBN39bS
Uspzgb8c8+
B5a6SE2Q8pTIqXO
PUsE2JOAWVrgQSQ
pu/xO28QOG8=
-----END CERTIFICATE-----
---
Server certificate
subject=OU = Domain Control Validated, CN = *.manitu.de
issuer=C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Domain Validation Secure Server CA
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 5741 bytes and written 386 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_
Server public key is 4096 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
Protocol : TLSv1.3
Cipher : TLS_AES_
Session-ID: 5647EA0E9B48DD3
Session-ID-ctx:
Resumption PSK: 5FB013801EE9FAF
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 7200 (seconds)
TLS session ticket:
0000 - f0 92 f5 ea 57 92 98 bf-a7 d5 08 4d 40 2d 76 81 ....W......M@-v.
0010 - 4e bf 76 93 a0 cd 6e fd-19 d2 d0 8e ac ee 56 37 N.v...n.......V7
0020 - b9 3c 71 4f 50 7f f5 ea-a9 49 64 23 a2 1b 93 f1 .<qOP....Id#....
0030 - d2 ad 96 7d 12 1b 34 11-8c 25 f9 7f e1 a4 c9 a9 ...}..4..%......
0040 - 35 1c d3 60 8a 5f bb e1-01 f6 ca 8f 22 2b ad c2 5..`._......"+..
0050 - 20 a0 7f 8d 6a 60 5c 7d-89 10 23 02 be 50 bd d9 ...j`\}..#..P..
0060 - 44 6f b0 bd 39 a9 3e 3d-c1 a8 43 ba cf de 8e 5c Do..9.>=..C....\
0070 - 89 4f 6c b4 96 99 2a 79-4e fc 44 26 4a b6 20 f2 .Ol...*yN.D&J. .
0080 - 41 9c 4f f8 31 41 d2 83-63 9d 3e ad a3 af b1 af A.O.1A..c.>.....
0090 - 2e 78 01 a5 4e 38 c1 13-f9 e7 9e a9 26 30 15 ff .x..N8......&0..
00a0 - de 8e 90 6c cc c3 94 67-d8 d1 37 c6 06 43 c1 73 ...l...g..7..C.s
00b0 - 55 1e 44 bf 60 96 71 92-18 65 ec 0a 7f 48 5e bd U.D.`.q..e...H^.
00c0 - d6 e9 cf cf e2 f6 2c 13-e4 4a 20 94 6a e7 42 53 ......,..J .j.BS
00d0 - d6 16 27 a3 e2 b1 e5 c6-9d d5 a9 76 30 31 a9 2b ..'........v01.+
Start Time: 1590886172
Timeout : 7200 (sec)
Verify return code: 0 (ok)
Extended master secret: no
Max Early Data: 0
---
read R BLOCK
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
Protocol : TLSv1.3
Cipher : TLS_AES_
Session-ID: 1FF1B49AA77C472
Session-ID-ctx:
Resumption PSK: 3119C350C531C16
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 7200 (seconds)
TLS session ticket:
0000 - f0 92 f5 ea 57 92 98 bf-a7 d5 08 4d 40 2d 76 81 ....W......M@-v.
0010 - 11 fc b0 60 ee 14 8f 20-9e ca 27 ca 50 47 72 cd ...`... ..'.PGr.
0020 - 72 99 71 fe f4 14 41 5b-1a 89 16 9a a1 be 06 15 r.q...A[........
0030 - 59 80 3a 91 a0 3f d4 f8-85 5e 09 1c 7b 7d 1d ad Y.:..?...^..{}..
0040 - 70 4d 5c 9b a7 9f 9b e8-e8 a7 39 d5 74 53 47 cd pM\.......9.tSG.
0050 - 6c aa 96 40 0a 63 ce cd-a8 cb 4d fb 45 77 c6 b1 l..@.c....M.Ew..
0060 - f4 ff ed fb b9 5d 3f 75-36 62 70 50 f0 d0 42 e5 .....]?u6bpP..B.
0070 - ad c6 30 d4 80 e8 c3 6d-5c bd c8 fd 80 2f 0d fd ..0....m\..../..
0080 - da 1c 2a 43 ff 52 db 86-e2 63 fb a5 23 e4 e4 46 ..*C.R...c..#..F
0090 - 6d 1c f4 c9 20 ce a4 bf-1d dd b9 3d 70 88 a3 53 m... ......=p..S
00a0 - bc cb 0c 84 de 51 34 38-56 26 f5 e8 16 e4 77 fa .....Q48V&....w.
00b0 - 93 af 53 6f 22 44 98 c0-a5 46 f0 38 02 89 e4 e5 ..So"D...F.8....
00c0 - 05 f9 78 3f 43 da b6 71-0d a3 20 25 fe f0 c2 fc ..x?C..q.. %....
00d0 - c8 1f 73 05 4d 39 ab 24-e2 87 47 f5 52 e6 a5 e9 ..s.M9.$..G.R...
Start Time: 1590886172
Timeout : 7200 (sec)
Verify return code: 0 (ok)
Extended master secret: no
Max Early Data: 0
---
read R BLOCK
* OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ AUTH=PLAIN AUTH=LOGIN] Dovecot ready.
###
lsb_release -rd
###
Description: Ubuntu 20.04 LTS
Release: 20.04
###
apt-cache policy mutt
###
mutt:
Installed: 1.13.2-1
Candidate: 1.13.2-1
Version table:
*** 1.13.2-1 500
500 http://
100 /var/lib/
###
mutt -v
###
mutt -v
Mutt 1.13.2 (2019-12-18)
Copyright (C) 1996-2016 Michael R. Elkins and others.
Mutt comes with ABSOLUTELY NO WARRANTY; for details type `mutt -vv'.
Mutt is free software, and you are welcome to redistribute it
under certain conditions; type `mutt -vv' for details.
System: Linux 5.4.0-31-generic (x86_64)
ncurses: ncurses 6.2.20200212 (compiled with 6.1)
libidn: 1.33 (compiled with 1.33)
hcache backend: tokyocabinet 1.4.48
Compiler:
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_
OFFLOAD_
OFFLOAD_
Target: x86_64-linux-gnu
Configured with: ../src/configure -v --with-
Thread model: posix
gcc version 9.2.1 20191130 (Ubuntu 9.2.1-22ubuntu1)
Configure options: '--build=
Compilation CFLAGS: -Wall -pedantic -Wno-long-long -g -O2 -fdebug-
Compile options:
-DOMAIN
+DEBUG
-HOMESPOOL +USE_SETGID +USE_DOTLOCK +DL_STANDALONE +USE_FCNTL -USE_FLOCK
+USE_POP +USE_IMAP +USE_SMTP
-USE_SSL_OPENSSL +USE_SSL_GNUTLS +USE_SASL +USE_GSS +HAVE_GETADDRINFO
+HAVE_REGCOMP -USE_GNU_REGEX
+HAVE_COLOR +HAVE_START_COLOR +HAVE_TYPEAHEAD +HAVE_BKGDSET
+HAVE_CURS_SET +HAVE_META +HAVE_RESIZETERM +HAVE_FUTIMENS
+CRYPT_
-EXACT_ADDRESS -SUN_ATTACHMENT
+ENABLE_NLS -LOCALES_HACK +HAVE_WC_FUNCS +HAVE_LANGINFO_
+HAVE_ICONV -ICONV_NONTRANS +HAVE_LIBIDN -HAVE_LIBIDN2 +HAVE_GETSID +USE_HCACHE
+USE_SIDEBAR +USE_COMPRESSED +USE_INOTIFY
-ISPELL
SENDMAIL=
MAILPATH=
PKGDATADIR=
SYSCONFDIR="/etc"
EXECSHELL="/bin/sh"
MIXMASTER=
To contact the developers, please mail to <email address hidden>.
To report a bug, please contact the Mutt maintainers via gitlab:
https:/
###
Status changed to 'Confirmed' because the bug affects multiple users.