I've read quite a few posts regarding inadequate key usage and I think I understood how to make curl accept self-signed certificates, but I still can't make it work for me:
I have a trust store that contains the CA of my certificate:
./my.trust.crt
I retrieved the cert ./my.server.com.pem from the server using
> openssl s_client -showcerts -servername my.server.com -connect my.server.com:443
I checked that the certificate is fit for use:
> openssl verify -purpose sslserver -CAfile ./my.trust.crt my.server.com.pem
my.server.com.pem: OK
>
But still, curl complains:
> curl -v --cacert ./my.trust.crt https://my.server.com
* About to connect() to my.server.com port 443 (#0)
* Trying 192.168.x.y...
* Connected to my.server.com (192.168.x.y) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* CAfile: ./my.trust.crt
CApath: none
* Server certificate:
* subject: CN=my.server.com,OU=x,O=y,L=z,ST=ZH,C=CH
* start date: Mar 07 13:19:00 2019 GMT
* expire date: Mar 07 13:19:00 2029 GMT
* common name:my.server.com
* issuer: CN=My Certificate Authority,O=y,L=z,ST=ZH,C=CH
* NSS error -8102 (SEC_ERROR_INADEQUATE_KEY_USAGE)
* Certificate key usage inadequate for attempted operation.
* Closing connection 0
curl: (60) Certificate key usage inadequate for attempted operation.
More details here: http://curl.haxx.se/docs/sslcerts.html
...
Any hints on how I could in find out what the problem is? Is my openssl verification correct? Anything else I'm doing wrong?
Additional info: there is a single CA in the ca "bundle". Anonymized contents of both CA and server certs as per suggestion (thanks!)
> openssl x509 -in my.server.pem -noout -text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
c2:48:fb:ed:52:57:1e:24
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=CH, ST=ZH, L=Z, O=Company, CN=Company Certificate Authority
Validity
Not Before: Mar 7 13:19:00 2019 GMT
Not After : Mar 7 13:19:00 2024 GMT
Subject: C=CH, ST=ZH, L=Z, O=Company, OU=Dept, CN=my.server.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
<lots of hex stuff>
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
X509v3 Subject Key Identifier:
A4:51:53:0C:51:01:2F:51:48:D1:C0:49:B3:8B:CF:BD:7B:91:27:40
X509v3 Authority Key Identifier:
keyid:91:E5:80:D7:86:77:4C:B8:16:19:49:DF:74:E4:A7:05:D2:86:12:FE
DirName:/C=CH/ST=ZH/L=Z/O=Company/CN=Company Certificate Authority
serial:C2:48:FB:ED:52:57:1D:8B
X509v3 Key Usage: critical
Digital Signature
X509v3 Extended Key Usage: critical
TLS Web Server Authentication
X509v3 Subject Alternative Name:
DNS:my.server.com, DNS:my-1.server.com, DNS:my-2.server.com
Signature Algorithm: sha256WithRSAEncryption
<lots of hex stuff>
> openssl x509 -in my.trust.crt -noout -text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
c2:48:fb:ed:52:57:1d:8b
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=CH, ST=ZH, L=Z, O=Company, CN=Company Certificate Authority
Validity
Not Before: Sep 9 11:49:46 2015 GMT
Not After : Sep 9 11:49:46 2025 GMT
Subject: C=CH, ST=ZH, L=Z, O=Company, CN=Company Certificate Authority
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (4096 bit)
Modulus:
<lots of hex stuff>
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
91:E5:80:D7:86:77:4C:B8:16:19:49:DF:74:E4:A7:05:D2:86:12:FE
X509v3 Authority Key Identifier:
keyid:91:E5:80:D7:86:77:4C:B8:16:19:49:DF:74:E4:A7:05:D2:86:12:FE
X509v3 Basic Constraints:
CA:TRUE
Signature Algorithm: sha256WithRSAEncryption
<lots of hex stuff>
No Trusted Uses.
No Rejected Uses.
Alias: Company Certificate Authority
As #SteffenUllrich correctly pointed out: the keyEncipherment usage was missing in the server certificate. Adding this (respectively creating certificates that include this usage) solved the issue!
I want to be able to look up a website and provide the registered organization for that website.
For example get_company("google.com") -> Google LLC. However, some websites that are signed and display their certificates correctly when opened in chrome don't work. For example "microsoft.com" is one that doesn't work. How can I look those other ones up?
import ssl
import socket
import OpenSSL
def get_certificate(host, port=443, timeout=10):
context = ssl.create_default_context()
conn = socket.create_connection((host, port))
sock = context.wrap_socket(conn, server_hostname=host)
sock.settimeout(timeout)
try:
der_cert = sock.getpeercert(True)
finally:
sock.close()
return ssl.DER_cert_to_PEM_cert(der_cert)
def get_company(url):
certificate = get_certificate(url)
x509 = OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_PEM, certificate)
return dict(x509.get_subject().get_components())[b'O']
EDIT:
Just to clarify, I am not interested in certificates made by Authorities like Let's Encrypt and I can filter them. They are unrelated to the question. The specific example I posted was because when I go to microsoft.com in Google Chrome I can see the subject field contains the organization.
There are multiple validation types of X.509 certificates. Those specify which informations are part of the certificate (and thus validated by the CA issuing the certificate).
Domain Validated (DV): The subject of those certificates contains exactly one value: The domain. Those are very common these days, since that's what you get from Let's Encrypt
Organization Validated (OV): In addition to the domain, the certificate's subject also contains information about the certificate's owner. Usually just an organization name, sometimes also an actualy name or an organizational unit (OU).
The certificate you have problem with, is probably a DV certificate which simply does not have any organization information in its subject (which you are trying to parse).
The certificate currently used on microsoft.com is:
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
78:00:0f:e6:92:e4:bd:9e:fe:63:c5:71:67:00:00:00:0f:e6:92
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 4
Validity
Not Before: Feb 5 20:30:44 2020 GMT
Not After : Feb 5 20:30:44 2022 GMT
Subject: CN=microsoft.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:f1:1c:98:26:23:0f:fe:d2:ab:5d:a0:81:07:06:
ed:48:49:1b:8e:56:04:bb:de:80:df:06:6f:5a:5a:
96:3d:80:1e:3b:7a:aa:9d:c7:43:a0:fa:75:89:a9:
38:3c:20:52:cd:43:47:32:43:eb:ad:e7:50:37:b1:
3a:53:d1:2d:54:b2:4d:f4:1f:fb:16:ab:bb:50:53:
d5:b2:71:2b:a9:0c:fa:77:45:a6:fe:62:74:e1:e3:
cd:28:17:52:5c:4c:45:0d:7e:65:f8:44:9e:0f:9e:
34:1c:5d:e8:f0:b2:4f:1c:2c:9c:8b:a1:ae:74:a1:
1d:d8:2e:fb:10:3d:45:fd:02:cf:1f:d4:c8:8b:d5:
18:01:64:c0:ee:01:68:e0:db:da:79:5e:57:ff:a0:
a6:64:95:cf:68:4b:36:58:16:45:b0:0d:12:23:11:
e0:04:ae:e6:fc:5f:71:29:ff:60:9e:e4:6d:ef:e3:
2e:1d:28:e9:1c:23:8c:33:27:f4:33:f6:56:fb:f1:
b4:fc:55:96:61:0f:fe:a7:84:e7:c0:3b:84:0d:69:
ef:4c:da:83:05:08:81:68:97:d7:34:af:50:0b:78:
92:77:fe:8b:75:25:e5:57:51:bb:5a:25:2b:62:89:
da:83:69:d8:8f:ff:ce:cb:56:63:1f:2d:0f:23:48:
27:ad
Exponent: 65537 (0x10001)
X509v3 extensions:
S/MIME Capabilities:
......0...`.H.e...*0...`.H.e...-0...`.H.e....0...`.H.e....0...+....0
..*.H..
1.3.6.1.4.1.11129.2.4.2:
...i.g.u.......X......gp
.....p..w......F0D. $...Um...v......*2..>*./m\5.*3... v..^.|...$8.....P....b.e...UD....v."EE.YU$V.?./..m..#&c..K.]..\n......p..w......G0E. jFy............./9?4z..d....F....!..H..v.GN.........rc.....wb6...k..v.U.....6.J...W<S...8xp%../..........p..v......G0E.!..{r...GS7...[.....].~7.P...4..Ev. LzM...4
......yj+...
1.3.6.1.4.1.311.21.10:
0.0
..+.......0
..+.......
1.3.6.1.4.1.311.21.7:
0/.'+.....7.....u...........a...`.]...B...z..d...
Authority Information Access:
CA Issuers - URI:http://www.microsoft.com/pki/mscorp/Microsoft%20IT%20TLS%20CA%204.crt
OCSP - URI:http://ocsp.msocsp.com
X509v3 Subject Key Identifier:
89:47:51:EA:1F:28:84:F0:D5:35:E4:97:C7:53:D6:82:D0:BE:C0:46
X509v3 Key Usage:
Digital Signature, Key Encipherment, Data Encipherment
X509v3 Subject Alternative Name:
DNS:microsoft.com, DNS:s.microsoft.com, DNS:ga.microsoft.com, DNS:mi.microsoft.com, DNS:grv.microsoft.com, DNS:hup.microsoft.com, DNS:mac.microsoft.com, DNS:mkb.microsoft.com, DNS:pme.microsoft.com, DNS:pmi.microsoft.com, DNS:rss.microsoft.com, DNS:sar.microsoft.com, DNS:tco.microsoft.com, DNS:ieak.microsoft.com, DNS:mac2.microsoft.com, DNS:mcsp.microsoft.com, DNS:shop.microsoft.com, DNS:spur.microsoft.com, DNS:build.microsoft.com, DNS:itpro.microsoft.com, DNS:mango.microsoft.com, DNS:music.microsoft.com, DNS:pymes.microsoft.com, DNS:store.microsoft.com, DNS:aether.microsoft.com, DNS:alerts.microsoft.com, DNS:design.microsoft.com, DNS:garage.microsoft.com, DNS:gigjam.microsoft.com, DNS:ignite.microsoft.com, DNS:msctec.microsoft.com, DNS:online.microsoft.com, DNS:stream.microsoft.com, DNS:tpmsec.microsoft.com, DNS:afflink.microsoft.com, DNS:connect.microsoft.com, DNS:develop.microsoft.com, DNS:domains.microsoft.com, DNS:example.microsoft.com, DNS:madeira.microsoft.com, DNS:msdnisv.microsoft.com, DNS:mspress.microsoft.com, DNS:quantum.microsoft.com, DNS:sponsor.microsoft.com, DNS:wwwbeta.microsoft.com, DNS:business.microsoft.com, DNS:empresas.microsoft.com, DNS:learning.microsoft.com, DNS:msdnwiki.microsoft.com, DNS:pinpoint.microsoft.com, DNS:snackbox.microsoft.com, DNS:sponsors.microsoft.com, DNS:stationq.microsoft.com, DNS:aistories.microsoft.com, DNS:community.microsoft.com, DNS:crawlmsdn.microsoft.com, DNS:messenger.microsoft.com, DNS:minecraft.microsoft.com, DNS:backoffice.microsoft.com, DNS:enterprise.microsoft.com, DNS:iotcentral.microsoft.com, DNS:pinunblock.microsoft.com, DNS:reroute443.microsoft.com, DNS:communities.microsoft.com, DNS:explore-smb.microsoft.com, DNS:expressions.microsoft.com, DNS:ondernemers.microsoft.com, DNS:techacademy.microsoft.com, DNS:terraserver.microsoft.com, DNS:communities2.microsoft.com, DNS:connectevent.microsoft.com, DNS:dataplatform.microsoft.com, DNS:entrepreneur.microsoft.com, DNS:hxd.research.microsoft.com, DNS:mspartnerira.microsoft.com, DNS:oemcommunity.microsoft.com, DNS:real-stories.microsoft.com, DNS:www.formspro.microsoft.com, DNS:futuredecoded.microsoft.com, DNS:powerautomate.microsoft.com, DNS:smallbusiness.microsoft.com, DNS:upgradecenter.microsoft.com, DNS:learnanalytics.microsoft.com, DNS:onlinelearning.microsoft.com, DNS:businesscentral.microsoft.com, DNS:cloud-immersion.microsoft.com, DNS:analyticspartner.microsoft.com, DNS:businessplatform.microsoft.com, DNS:explore-security.microsoft.com, DNS:kleinunternehmen.microsoft.com, DNS:partnercommunity.microsoft.com, DNS:explore-marketing.microsoft.com, DNS:innovationcontest.microsoft.com, DNS:partnerincentives.microsoft.com, DNS:phoenixcataloguat.microsoft.com, DNS:szkolyprzyszlosci.microsoft.com, DNS:www.powerautomate.microsoft.com, DNS:successionplanning.microsoft.com, DNS:lumiaconversationsuk.microsoft.com, DNS:successionplanninguat.microsoft.com, DNS:businessmobilitycenter.microsoft.com, DNS:skypeandteams.fasttrack.microsoft.com, DNS:www.microsoftdlapartnerow.microsoft.com, DNS:commercialappcertification.microsoft.com, DNS:www.skypeandteams.fasttrack.microsoft.com
X509v3 CRL Distribution Points:
Full Name:
URI:http://mscrl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%204.crl
URI:http://crl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%204.crl
X509v3 Certificate Policies:
Policy: 1.3.6.1.4.1.311.42.1
CPS: http://www.microsoft.com/pki/mscorp/cps
X509v3 Authority Key Identifier:
keyid:7A:7B:8C:C1:CF:E7:A0:CA:1C:D4:6B:FA:FB:E1:33:C3:0F:1A:A2:9D
X509v3 Extended Key Usage:
TLS Web Client Authentication, TLS Web Server Authentication
Signature Algorithm: sha256WithRSAEncryption
1f:d8:61:7a:61:9e:d0:15:f9:4b:72:e4:33:e9:13:0c:7b:75:
c4:5b:06:19:97:dd:f7:d3:c9:2f:15:2c:ee:83:46:bd:8a:d0:
8a:6c:bc:5e:74:d2:53:80:58:17:ea:fd:d8:83:01:0e:d8:24:
b5:ee:34:de:5d:bb:d2:16:65:af:fd:59:89:38:c1:af:c0:cf:
e7:31:76:fb:22:b9:6f:f7:b6:91:54:2d:c9:da:81:cb:8f:84:
b4:0c:8b:c6:f4:5e:6c:65:a3:ec:c3:be:02:29:8f:67:d3:ef:
84:58:8f:18:75:0a:bb:97:63:1e:51:b2:1a:35:11:12:61:45:
26:29:69:08:19:d3:b8:07:96:f0:ff:00:19:40:5e:80:30:83:
c1:91:81:bb:64:f7:16:df:9f:fc:82:a2:3d:2e:f2:f9:46:60:
e4:95:ef:41:2b:69:b6:f6:7f:8d:69:bf:82:72:01:d5:d9:34:
8e:f4:70:67:92:8b:ea:34:b5:cb:b1:b4:71:d4:05:05:a8:d4:
b6:56:c4:0e:5e:94:05:ce:48:72:54:52:d7:67:03:dd:fc:5b:
1d:5d:27:09:65:f1:d3:ee:8c:36:84:35:28:89:26:88:ae:35:
6e:ee:96:64:51:b6:09:0c:d7:5d:d9:60:e2:fb:31:5d:d5:8f:
e6:2e:0c:0b:00:f5:24:27:48:b3:1e:8b:ee:f3:73:8e:82:a9:
89:98:7a:ed:10:1d:52:ce:e5:b4:8a:d8:d8:d0:3a:b0:a7:0e:
da:15:7b:67:f2:3b:35:12:96:ad:87:74:29:d1:b4:db:e6:87:
37:6f:1d:6a:dc:02:aa:45:dd:15:e4:4a:9b:75:f3:22:4c:48:
25:a1:90:1e:55:b7:df:35:8f:67:2f:73:94:69:f0:65:b9:ff:
e8:12:83:ed:98:54:cb:a8:8e:06:7a:2a:45:09:ad:04:77:5b:
3a:bf:ed:24:35:38:e6:4a:45:49:04:26:05:4e:eb:35:7d:26:
c1:d5:dd:03:85:e6:a5:79:33:12:b2:53:ca:ab:67:fc:63:c7:
94:5b:27:30:ce:a5:05:61:f7:62:65:26:a0:d8:9e:3c:dd:35:
4d:51:0c:ab:ae:39:cb:94:b8:58:20:a0:ba:31:5f:e3:b7:d8:
b0:15:15:ec:ee:78:8a:e9:a8:62:ca:02:38:df:6e:dd:34:22:
7f:4f:96:f9:96:10:e7:5e:12:45:df:ed:6d:36:e8:a4:c1:af:
63:3c:ac:3b:f0:aa:bf:44:a5:d7:5c:02:c0:ce:56:58:c5:77:
f5:58:45:9a:64:3d:b2:a7:5f:97:d5:25:d2:e8:40:86:4b:bf:
1c:09:6a:d2:04:d7:d2:a4
Notice Subject: CN=microsoft.com . The subject name contains only the CommonName attribute, not the Organization attribute. And as with essentially all modern website (HTTPS) certs, and many other SSL/TLS certs also, the Subject field is a legacy value that isn't actually used to identify the subject(s) of the cert; the SubjectAlternativeName extension is used instead.
OTOH the CA that issued this cert is also part (a different part) of Microsoft:
Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 4
which does have an Organization attribute identifying Microsoft. However this is rare; very few companies run their own CAs. For example, the current certificate on stackoverflow.com is
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
03:d5:35:ed:f0:9f:bb:da:42:c1:0c:e8:c6:33:d5:39:38:d9
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3
Validity
Not Before: Jan 23 07:00:28 2020 GMT
Not After : Apr 22 07:00:28 2020 GMT
Subject: CN=*.stackexchange.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:9a:32:f8:05:bf:e1:14:7c:7c:39:f4:ce:37:c6:
ab:27:e2:7f:6d:73:68:8a:87:a2:c6:1e:f1:bd:39:
a3:52:86:99:a8:2d:45:91:e3:f6:ee:ea:ed:0b:ce:
6a:a9:30:94:97:83:5e:78:d9:8c:db:1a:e2:bc:e0:
ee:b2:b9:f9:b6:80:5a:e3:45:16:b2:fb:42:b7:ca:
e9:57:6d:87:fa:4a:44:6b:0b:5c:b4:12:63:17:a9:
13:2e:fd:85:0c:09:dd:43:c7:78:60:c6:d1:c2:b7:
56:61:d4:9e:72:b7:ea:64:5b:68:0f:d1:b4:5e:73:
08:6d:a5:ee:49:4f:e1:e6:d7:83:bd:4e:19:1a:e4:
4c:86:11:30:3a:a5:60:e9:fe:32:40:e1:be:8d:04:
80:28:a0:7a:7f:37:85:84:29:46:d3:93:8c:21:a1:
f6:cf:00:bd:dc:96:df:0c:94:c8:a3:b0:41:6d:1e:
4a:86:c0:51:c3:9a:7a:8c:55:e3:de:86:7d:1f:3d:
fb:0d:1f:83:ef:23:f6:f3:2a:a2:ff:47:87:a9:cd:
8e:d5:f2:3c:84:1b:88:34:86:63:15:a6:5d:c3:5b:
e8:04:65:20:88:d9:70:4d:d2:31:45:04:38:fa:b9:
3d:04:69:70:19:91:ef:65:79:18:a6:63:50:27:df:
87:9b
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Subject Key Identifier:
F0:61:88:B2:8F:1D:EB:1E:FF:68:BC:BD:7A:D0:AF:9C:0C:34:09:18
X509v3 Authority Key Identifier:
keyid:A8:4A:6A:63:04:7D:DD:BA:E6:D1:39:B7:A6:45:65:EF:F3:A8:EC:A1
Authority Information Access:
OCSP - URI:http://ocsp.int-x3.letsencrypt.org
CA Issuers - URI:http://cert.int-x3.letsencrypt.org/
X509v3 Subject Alternative Name:
DNS:*.askubuntu.com, DNS:*.blogoverflow.com, DNS:*.mathoverflow.net, DNS:*.meta.stackexchange.com, DNS:*.meta.stackoverflow.com, DNS:*.serverfault.com, DNS:*.sstatic.net, DNS:*.stackexchange.com, DNS:*.stackoverflow.com, DNS:*.stackoverflow.email, DNS:*.superuser.com, DNS:askubuntu.com, DNS:blogoverflow.com, DNS:mathoverflow.net, DNS:openid.stackauth.com, DNS:serverfault.com, DNS:sstatic.net, DNS:stackapps.com, DNS:stackauth.com, DNS:stackexchange.com, DNS:stackoverflow.blog, DNS:stackoverflow.com, DNS:stackoverflow.email, DNS:stacksnippets.net, DNS:superuser.com
X509v3 Certificate Policies:
Policy: 2.23.140.1.2.1
Policy: 1.3.6.1.4.1.44947.1.1.1
CPS: http://cps.letsencrypt.org
1.3.6.1.4.1.11129.2.4.2:
......v......... N.f.+..% gk..p..IS-...^...o.j.......G0E. Gt...N...O.wDE...~.P.~s..........!.....X....3.uW....z..*.....X......v.^.s..V...6H}.I.2z.........u..qEX...o.j.......G0E. Q...IB...\,.d.q3.T.2.v...z8..0...!.....6....uBJ.......xj....T...Vc.
Signature Algorithm: sha256WithRSAEncryption
17:cd:09:07:27:8f:14:2e:bc:f0:55:3d:f2:6f:dc:76:27:1e:
ed:55:95:66:64:87:a0:b6:6c:dd:71:e1:d2:cb:f6:44:c4:25:
f7:b3:5f:be:69:16:6b:f1:8b:63:b7:9f:07:73:47:9b:da:d5:
be:b1:6b:7b:c2:2a:7e:cc:e0:37:29:0d:c7:39:30:0f:84:2a:
a9:28:3d:93:a7:1d:33:7a:f0:72:73:b7:72:2e:2a:ab:96:65:
65:f5:af:0b:70:55:13:c7:2c:96:59:0a:b2:ef:c1:14:a2:51:
f6:c7:b3:ef:89:db:2c:7d:a7:8b:ac:17:c2:44:8e:b8:0a:12:
27:ff:bb:de:e7:5d:44:24:c0:1f:79:9b:3e:b1:65:a5:58:98:
cc:f5:ab:3d:e8:8a:70:db:1c:90:14:40:c5:1f:51:4b:b4:7a:
3c:2e:4b:c8:5e:2b:5d:86:42:2d:f1:e9:64:2a:53:00:10:88:
fc:7f:41:bd:8b:91:cc:2d:66:b2:af:ea:70:dd:61:cf:a5:c3:
37:3c:56:a5:db:fc:18:e4:ad:af:0d:42:82:cb:22:d6:d6:93:
54:5d:89:0e:03:d9:49:9f:80:ee:ab:f4:41:b1:0a:1f:82:4b:
94:a5:9e:a0:0d:e4:1e:ad:24:ba:1c:91:96:aa:82:df:12:76:
9e:54:04:55
which as you see also has only CommonName in Subject, and the real identities in SAN instead, but is issued by LetsEncrypt (exactly the case #mat referred to), so the Issuer Organization is Let's Encrypt. Do you want to report that stackoverflow and stackexchange etc are part of Let's Encrypt?
In general certificates are not required to be owned by an organization at all, much less a 'registered' one, and if one is, it isn't necessarily required to have that organization name contained in the cert.
ADDED: Okay, as noted in comments accessing microsoft.com with HTTPS (not just TLS) redirects to www.microsoft.com, which both your python and my OpenSSL ignored but browsers of course follow -- and (my) Chrome seriously confuses because it still shows microsoft.com/$path in the address bar. www.microsoft.com is on Akamai so you will get a different server than me and may get a different cert, but the cert I get is:
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
2d:00:0c:37:15:62:c4:1d:93:94:08:7f:68:00:00:00:0c:37:15
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 5
Validity
Not Before: Oct 21 22:04:04 2019 GMT
Not After : Oct 21 22:04:04 2021 GMT
Subject: C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=www.microsoft.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:d3:10:ad:42:cd:4c:1d:02:b1:0e:6f:fb:c3:3a:
a7:6c:ef:fb:d0:d7:21:90:b4:06:1a:65:83:41:72:
1d:bb:2b:0d:ff:5c:a9:df:b5:dd:cd:56:3e:ed:61:
ee:cc:84:8d:54:f9:b9:27:c6:14:b1:ee:6e:2d:8b:
b3:f3:b7:a9:b1:42:24:d9:fc:a7:a0:62:1c:68:b1:
dd:ec:38:48:a4:5e:02:55:cc:40:af:87:43:2f:77:
a6:9d:ae:f8:b4:d1:c5:1e:43:3d:1d:96:45:24:bb:
13:00:8e:21:6c:f8:55:fb:3a:07:f8:c6:df:2e:6f:
88:4a:64:f1:81:f3:9b:c3:9d:04:34:38:75:61:2f:
d2:2e:51:b6:07:86:68:7c:12:80:c4:75:1f:a8:83:
e9:63:ee:ee:4e:2a:dd:d8:11:69:ed:81:b9:df:57:
57:7a:e9:4e:7d:91:fa:79:0e:0e:13:ff:31:63:ab:
3f:e5:53:72:86:05:68:23:d1:8a:31:1f:c2:86:7e:
ea:b6:61:f1:50:b2:6e:d0:e0:c0:c9:9d:1d:8f:35:
46:f0:c2:b2:b9:26:57:5c:46:7d:bb:a3:94:95:67:
16:81:e7:96:ec:77:21:d6:2f:41:9b:1b:92:68:20:
85:a0:f2:91:89:5c:a6:06:7c:04:43:11:58:d6:8a:
30:4f
Exponent: 65537 (0x10001)
X509v3 extensions:
1.3.6.1.4.1.11129.2.4.2:
...h.f.v..\./.w0".T..0.V..M..3.../ ..N.d....m.bqq.....G0E.!.......L.O.:D.9.F...
.e..$..<..... ..s....'}..o..+....EL.1bN.W.&....u.U.....6.J...W<S...8xp%../..........m.br......F0D. Z&..b.>...r....j-.D.2nH.q{.D.&... E...........D.9.gp.iE(.CO.+B2.~S.u.}>.....Uh$....R.y+..x...j.h.~".....m.bq......F0D. d..z%.t..W.C.}E+.....~...>).1.O.. h....%<..N..9w...VY.......x...fC
1.3.6.1.4.1.311.21.10:
0.0
..+.......0
..+.......
1.3.6.1.4.1.311.21.7:
0/.'+.....7.....u...........a...`.]...B...z..d...
Authority Information Access:
CA Issuers - URI:http://www.microsoft.com/pki/mscorp/Microsoft%20IT%20TLS%20CA%205.crt
OCSP - URI:http://ocsp.msocsp.com
X509v3 Subject Key Identifier:
F6:AB:BF:05:1E:41:B7:70:E9:91:F8:1A:95:6E:F6:0C:2B:09:FB:95
X509v3 Key Usage:
Digital Signature, Key Encipherment, Data Encipherment
X509v3 Subject Alternative Name:
DNS:wwwqa.microsoft.com, DNS:www.microsoft.com, DNS:staticview.microsoft.com, DNS:i.s-microsoft.com, DNS:microsoft.com, DNS:c.s-microsoft.com, DNS:privacy.microsoft.com
X509v3 CRL Distribution Points:
Full Name:
URI:http://mscrl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%205.crl
URI:http://crl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%205.crl
X509v3 Certificate Policies:
Policy: 1.3.6.1.4.1.311.42.1
CPS: http://www.microsoft.com/pki/mscorp/cps
X509v3 Authority Key Identifier:
keyid:08:FE:25:9F:74:EA:87:04:C2:BC:BB:8E:A8:38:5F:33:C6:D1:6C:65
X509v3 Extended Key Usage:
TLS Web Client Authentication, TLS Web Server Authentication
Signature Algorithm: sha256WithRSAEncryption
75:63:1a:5b:73:4e:3f:96:2b:e3:b4:a8:c3:55:19:34:b3:26:
0e:5c:4d:8f:3f:bc:0d:c1:e2:7e:54:1f:2a:c2:26:3a:fb:3f:
51:f9:54:ac:c1:97:1b:ba:c7:e7:b3:5b:25:9f:67:62:94:93:
1d:6c:52:25:f2:ac:18:f7:37:a6:07:39:47:5b:31:67:10:db:
ea:50:6e:5c:43:7d:36:f8:49:32:63:f0:06:4c:8a:24:00:27:
8d:83:7a:c8:23:59:3f:85:fa:74:13:8e:35:6f:2e:a2:99:27:
17:e0:91:1c:36:5d:4a:23:1a:16:21:38:7d:50:9e:d0:ba:ce:
f7:46:f8:44:e3:ec:45:5f:33:1e:7e:7b:8b:50:75:eb:d9:f5:
72:ab:0b:5e:b3:07:bc:ad:17:9e:ee:eb:c2:bb:ef:77:90:5b:
39:aa:a6:ec:3a:e0:c0:96:14:93:45:1c:88:d1:1f:73:23:76:
74:d4:5c:0b:1a:1f:59:07:55:19:0a:af:6a:0a:ad:8f:20:c2:
9b:f1:09:e8:32:76:91:69:65:18:78:da:b9:cf:08:90:c6:94:
78:27:9d:4d:8a:61:0a:11:1c:91:7a:11:05:98:a4:66:dc:8b:
d2:86:63:eb:b8:8a:86:de:a6:9b:87:d2:4f:ec:74:66:eb:b9:
c1:dc:d4:a0:24:d0:b0:d4:c7:57:41:92:6d:c5:48:45:c8:26:
68:d8:b0:3f:ed:3e:96:b4:68:71:4a:e3:da:1f:fb:d8:84:0d:
f0:f7:bf:f8:2a:c3:79:52:4d:94:a0:3d:81:63:65:fa:dd:45:
fe:bd:c2:29:69:e4:10:dc:8d:50:24:e0:82:20:92:a2:37:58:
f5:19:23:d6:b4:e2:78:fe:8c:48:15:19:05:67:f7:30:1e:57:
22:e6:8b:39:33:b4:ff:08:4c:f3:7d:64:af:13:46:fe:4d:26:
74:2a:43:b5:d2:af:08:a2:1c:01:1a:e4:28:cf:40:dd:3c:6d:
56:93:9d:f1:ff:64:89:f7:06:68:fa:93:41:8a:fc:7f:18:6b:
34:1f:3a:e2:ab:02:1b:5e:e8:f1:97:24:04:a5:bc:15:8e:47:
fe:34:90:01:96:f5:a9:bc:2c:4d:b0:4c:5c:92:2b:d2:50:0f:
c0:7e:cb:20:01:c9:27:2b:25:1b:45:f7:32:9d:00:46:e9:86:
5a:a5:70:88:73:82:68:b5:ce:d6:24:90:5f:4c:16:e3:2a:3e:
94:6c:56:38:db:ce:22:86:9d:d8:d7:9d:fd:fc:4c:eb:be:5f:
11:50:be:af:e0:c8:e8:12:9b:b7:d0:a1:7c:85:e2:5d:e5:0b:
a8:e6:42:df:2a:76:16:8f
which does have Organization (and Org Unit) in the Subject, as you want. This may or may not be true for other websites/companies.
I have two extremely similar self signed certificates, generated via two different methods.
To test them I have:
Added an entry in my hosts file for local.mydomain.com
Set up an nginx server to listen on that domain on port 443 with the certificate under test plus associated private key (I then switch the cert and restart nginx to compare)
Connected to nginx with openssl s_client -connect local.mydomain.com -CAfile /path/to/the/ca/cert.pem
One certificate fails:
CONNECTED(00000003)
depth=0 CN = local.mydomain.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = local.mydomain.com
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
0 s:/CN=local.mydomain.com
i:/CN=local.mydomain.com
---
One certificate succeeds:
CONNECTED(00000003)
depth=0 CN = local.mydomain.com
verify return:1
---
Certificate chain
0 s:/CN = local.mydomain.com
i:/CN = local.mydomain.com
---
I compare the details of the certificates with openssl x509 -in /path/to/the/ca/cert.pem -text -noout
The failing cert:
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
47:dc:02:c7:11:fc:8e:96:45:22:aa:6b:23:79:32:ca
Signature Algorithm: sha256WithRSAEncryption
Issuer: CN=local.mydomain.com
Validity
Not Before: Nov 18 11:55:31 2016 GMT
Not After : Nov 18 12:15:31 2017 GMT
Subject: CN=local.mydomain.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
<stuff>
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
X509v3 Extended Key Usage:
TLS Web Client Authentication, TLS Web Server Authentication
X509v3 Subject Alternative Name:
DNS:local.mydomain.com
X509v3 Subject Key Identifier:
6D:4F:AF:E4:60:23:72:E5:83:27:91:7D:1D:5F:E9:7C:D9:B6:00:2A
Signature Algorithm: sha256WithRSAEncryption
<stuff>
The working cert:
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
9b:6b:3d:a3:b9:a3:a4:b4
Signature Algorithm: sha256WithRSAEncryption
Issuer: CN=local.mydomain.com
Validity
Not Before: Nov 19 13:27:30 2016 GMT
Not After : Nov 19 13:27:30 2017 GMT
Subject: CN=local.mydomain.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
<stuff>
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
03:E7:DA:AA:2E:CC:23:ED:C5:07:3D:E1:33:86:F5:22:D4:76:EB:CB
X509v3 Authority Key Identifier:
keyid:03:E7:DA:AA:2E:CC:23:ED:C5:07:3D:E1:33:86:F5:22:D4:76:EB:CB
X509v3 Basic Constraints:
CA:TRUE
Signature Algorithm: sha256WithRSAEncryption
57<stuff>
Looking at this the most obvious difference is that the working cert has CA:TRUE under X509v3 Basic Constraints. However, from reading around the web I was under the impression that self signed certs weren't meant to be CAs, in particular this says they normally won't be:
https://security.stackexchange.com/questions/44340/basic-self-signed-certificate-questions
The answer there says that being self-signed there is no CA involved. But maybe openssl requires self signed certs to have that set anyway?
From my own experiments I can confirm what you see. My explanation of the behavior is that a self signed certificate is still a certificate which is signed by the issuer, even if the issuer's certificate is the certificate itself. But only CA certificates can be used to sign certificates, i.e. that's exactly the constraint CA:true allows. This means that a self-signed certificate needs also to be a CA certificate with the constraint CA:true.
RFC5280 says:
So, if your certificate does not have CA:TRUE flag, this certificate may not be used to verify the signature on any certificate, including itself. OpenSSL correctly follows the RFC.
It is incorrect to think that a certificate belongs to one of two types, either "CA certificate" or "end-entity certificate". A certificate with CA:TRUE can be used for authenticating the entity. This is exactly what you do when you authenticate with a self-signed certificate. It can also be a certificate with CA:TRUE, signed by someone else.
I followed the link https://jamielinux.com/docs/openssl-certificate-authority/create-the-root-pair.html to create root CA and intermediate CA. Intermediate CA was signed by root CA.
When I check the intermediate CA (below is the output), you can find the issuer and subject are different(I mean root CA signed the intermediate certificate)
openssl x509 -noout -text -in certs/intermediate.cert.pem
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 4096 (0x1000)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=IN, ST=Karnataka, L=JP Nager, O=XXX, OU=xxx, CN=abc/emailAddress=abc#xyz.com
Validity
Not Before: Jul 14 09:05:19 2016 GMT
Not After : Jul 12 09:05:19 2026 GMT
Subject: C=IN, ST=Karnataka, O=XXX, OU=xxx, CN=Ipad Intermidiate Certificate
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (4096 bit)
Modulus (4096 bit):
00:c6:44:d6:78:0d:f3:bc:69:8d:31:ce:00:01:8d:
d4:1b:ee:de:96:16:13:00:1e:f6:0e:7b:00:35:f2:
57:48:fc:fb:0c:38:9e:0e:d2:67:d0:b9:82:3d:28:
29:94:0a:95:a2:e2:5e:88:e7:77:cf:23:a3:2d:8a:
46:fa:d9:a7:c5:41:fc:b9:73:65:03:c1:98:8b:c3:
0a:e8:dc:4b:c5:cb:2f:5b:97:7a:46:9d:85:74:ae:
0c:c1:15:7d:58:c5:ea:7f:29:17:aa:e9:34:e9:f4:
9e:50:bb:ce:f3:59:26:aa:63:cc:f7:d4:03:0b:20:
83:10:a6:dc:d8:e0:6b:3b:ae:dd:14:20:ec:6a:93:
5e:83:11:cd:4b:3d:e0:08:a5:fb:b0:27:e3:2e:86:
45:1e:1c:d6:19:bd:8b:5d:fa:37:18:ad:fd:e2:ce:
b0:39:8a:5c:5a:d0:1d:46:8b:74:22:35:c0:9f:e7:
01:c7:0b:50:4f:ab:e2:01:90:3e:c5:d8:15:48:aa:
fe:4c:96:5e:fb:3f:3a:69:4c:d9:22:2a:5e:4e:39:
cc:75:0a:14:44:39:e6:5d:1b:f2:97:fc:a5:b1:c0:
ac:a5:21:49:56:ad:55:e4:08:54:af:17:14:47:f1:
47:03:4d:ac:c4:02:ae:5f:e8:d6:9c:fe:92:36:e3:
cd:30:65:60:56:c8:6e:0c:5a:df:08:b9:63:2e:4a:
d9:c3:af:20:32:81:7b:fa:0a:d6:0d:0c:5c:a0:36:
9c:fd:0d:d3:64:29:f5:e5:2b:16:86:65:06:7c:fc:
db:ed:e2:2b:02:5a:ae:53:63:30:48:59:6b:1d:3b:
5e:68:6e:2b:90:92:df:73:d9:10:1a:73:d0:da:e3:
4e:49:61:ea:ca:d9:b8:2d:4e:c5:26:e6:38:02:84:
fb:80:8b:97:55:d1:c2:2d:30:29:0c:25:cb:a4:6b:
d3:8d:c5:ec:40:76:5e:e5:8e:ed:4b:86:cb:c7:9b:
d1:3a:89:f3:97:ff:e9:8f:a7:6b:8d:d2:ca:00:cd:
f0:a7:3d:74:3b:6d:db:6c:d1:2c:f5:89:24:e8:6d:
7d:fe:f6:56:8e:62:8b:02:a4:5e:27:20:50:18:99:
c6:4a:38:70:8b:0a:bb:aa:16:b5:4d:54:29:29:46:
44:dd:4d:53:cd:82:8f:97:8b:a8:6e:17:33:6f:15:
16:08:31:e2:d7:bc:7e:46:a9:58:a9:2e:26:14:fb:
7d:38:30:10:9e:5d:2c:8e:6d:bf:f5:03:ed:bf:37:
b6:0c:9d:35:83:84:76:11:16:e2:14:f2:47:d5:7e:
1b:a2:da:74:ff:e1:e0:b2:07:f5:9d:4c:08:fa:c1:
5c:8f:1d
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
D5:58:FE:D4:78:8A:93:77:28:65:04:D6:41:DB:A1:B0:FC:3E:37:F2
X509v3 Authority Key Identifier:
keyid:91:8E:47:44:08:F0:30:70:3A:9F:46:4C:C5:C9:D6:0C:17:D3:26:5D
X509v3 Basic Constraints: critical
CA:TRUE, pathlen:0
X509v3 Key Usage: critical
Digital Signature, Certificate Sign, CRL Sign
Signature Algorithm: sha256WithRSAEncryption
90:80:df:ee:2d:37:33:ea:02:fc:95:dc:e5:04:e9:c2:75:4c:
85:39:a1:ee:86:94:13:6d:94:75:4d:35:be:2a:45:d6:50:7c:
e9:ec:49:51:80:6c:c2:3e:5d:ea:e5:fb:c2:d5:1a:c4:ad:be:
58:24:8a:c0:9f:8a:d3:df:5c:02:94:bb:e5:c0:cf:8c:76:7b:
9c:24:b2:af:37:fe:a2:a8:e3:6c:9b:bc:7b:2f:88:f0:99:1e:
3e:b7:40:76:c4:64:41:b8:70:67:09:ce:51:f2:16:b8:af:23:
Output of root ca certificate
openssl x509 -noout -text -in ca/certs/ca.cert.pem
Certificate:
Data:
Version:3 (0x2)
Serial Number:d1:4f:18:94:21:32:f1:c2
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=IN, ST=Karnataka, L=JP Nager, O=XXX, OU=xxx, CN=abc/emailAddress=abc#xyz.com
Validity
Not Before: Jul 14 07:07:30 2016 GMT
Not After : Jul 9 07:07:30 2036 GMT
Subject: C=IN, ST=Karnataka, L=JP Nager, O=XXX, OU=xxx, CN=abc/emailAddress=abc#xyz.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (4096 bit)
Modulus (4096 bit):
00:d4:f5:ac:3b:8f:85:d6:2b:e9:fc:d8:5c:7b:99:
85:70:2d:96:c3:fc:5c:25:79:07:a0:62:f6:2e:aa:
8a:5f:62:18:2c:3d:c1:18:9c:8d:46:d1:c1:da:7f:
7a:92:02:bc:31:86:d6:e2:19:f3:b1:6f:39:73:1d:
48:df:3a:a4:a3:8e:3a:b2:1a:46:50:6e:e5:af:b3:
a2:c2:eb:c7:73:70:2b:06:02:e8:2b:65:72:76:90:
1e:22:54:42:07:c6:2a:d5:4e:aa:4d:f8:29:b6:88:
e7:66:c8:e2:06:30:c1:05:4a:a1:5a:ec:90:d0:e2:
1a:15:69:d7:18:89:9a:d1:21:43:62:46:00:68:fd:
cd:bb:21:be:1b:4d:3e:7c:14:8b:b1:10:e5:c4:f8:
82:13:a8:b8:be:d8:99:ae:14:d8:46:c6:cb:e5:1a:
77:e7:a5:e4:b4:0f:64:14:72:91:d3:b0:33:98:26:
d4:22:ac:84:f0:57:c7:b6:ff:f2:18:14:e9:a3:d3:
ce:46:ac:ee:a9:3b:a3:a8:75:c6:62:90:29:3f:fc:
91:e8:e9:d4:86:2a:50:53:fd:ff:44:5e:32:4a:40:
67:84:64:b5:c4:dd:51:74:0c:d6:93:2d:f9:c3:34:
66:4c:62:b4:cf:5d:ee:d7:2a:ce:22:15:90:56:ac:
e0:95:1e:81:50:31:51:8c:70:26:ae:34:55:eb:e0:
58:14:8a:91:b5:79:aa:b5:51:3a:14:99:40:8d:68:
5f:ab:63:7d:bb:9a:c7:ae:66:64:3c:b0:2b:36:90:
43:b7:7c:d8:42:a2:33:95:6f:c4:cf:7d:1c:7c:87:
af:d6:4d:50:73:91:ce:90:69:d4:51:3d:f3:d3:07:
92:fa:b0:d7:b0:e6:59:db:b8:de:7f:6b:7f:4b:4c:
71:69:49:a5:83:72:67:95:d6:2b:e5:d9:d3:e9:12:
43:c2:68:1b:37:85:3f:a7:2e:3e:d0:78:06:29:85:
31:f8:1e:2e:43:d5:ae:55:3c:80:38:1c:e0:84:61:
37:84:b4:8e:e8:30:48:da:2a:95:2b:0c:6c:2c:15:
ef:96:af:12:f9:4c:c2:96:f8:86:c4:d5:db:cc:6b:
4c:92:ca:39:ed:b6:72:e5:d2:78:24:38:c1:e1:b6:
bd:f0:7c:50:e6:c8:ec:ca:f4:ae:a6:52:0a:57:3b:
87:f8:1c:c1:f1:22:28:5a:5b:f1:c9:3b:68:70:32:
6c:e3:96:60:eb:70:64:79:38:d9:93:42:d9:38:2c:
be:42:02:23:6d:09:ab:56:6b:fd:5c:c8:dc:1e:de:
6f:fe:a7:69:2e:65:61:1d:54:6b:d5:6b:93:ac:89:
a3:20:47
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
91:8E:47:44:08:F0:30:70:3A:9F:46:4C:C5:C9:D6:0C:17:D3:26:5D
X509v3 Authority Key Identifier:
keyid:91:8E:47:44:08:F0:30:70:3A:9F:46:4C:C5:C9:D6:0C:17:D3:26:5D
X509v3 Basic Constraints: critical
CA:TRUE
X509v3 Key Usage: critical
Digital Signature, Certificate Sign, CRL Sign
Signature Algorithm: sha256WithRSAEncryption
20:b7:52:b6:0d:12:34:26:fe:b6:f3:20:7e:83:71:2c:a9:48:
4e:08:6f:87:a7:9d:89:38:a7:c1:f2:dd:f9:a3:54:87:24:09:
99:28:d8:5e:8a:a5:65:3d:1c:ee:82:68:cb:6c:5d:9d:51:3a:
06:ab:ea:b2:10:7c:6e:d8:f7:a5:1e:ed:19:18:2b:d0:36:93:
f5:e6:c1:00:b5:9c:b5:61:c9:13:52:6b:59:f7:da:ae:9a:c4:
ad:cb:6b:f4:07:22:45:69:c4:9c:a7:50:b7:47:4b:bc:52:73:
e9:7a:aa:8c:6c:ec:0f:ba:86:93:48:50:d3:32:4e:dc:df:96:
20:41:e0:47:c0:d4:cb:c2:54:9e:21:54:36:77:df:69:e3:0d:
3e:19:ee:a3:a4:d7:3d:d0:bb:63:a6:80:27:57:54:84:20:17:
79:3e:c8:19:4b:7e:1d:d4:cc:75:a2:9e:48:a6:8f:23:c2:a5:
a0:30:7d:a6:83:e6:14:9a:0e:91:58:de:71:46:0b:d2:ee:27:
d7:61:31:f9:2e:f7:c2:fa:19:76:21:a0:6a:46:b0:34:1f:25:
f0:ef:7f:b7:12:11:46:ec:28:de:b8:a2:f5:4e:ab:6d:a6:eb:
2e:77:f5:74:e9:b0:c0:58:99:c9:c8:97:8a:92:1a:95:d1:21:
9a:42:b5:df:f5:df:34:82:a8:2d:9d:41:4b:56:73:4f:84:dd:
fa:0d:b7:6a:9a:0f:e7:09:7a:0d:b7:d8:6e:97:a5:0e:bc:49:
6a:aa:7e:87:05:f2:73:00:5a:7b:ec:f5:2a:0f:04:c8:72:40:
24:d1:29:1d:d6:a9:ab:2c:09:4c:3c:9d:7e:a3:3e:c5:49:04:
71:8c:88:10:c7:dd:f7:9b:05:6f:e5:bf:e1:de:d1:b4:59:a8:
4c:ef:37:30:d2:71:fd:a6:7c:d6:88:6e:bc:73:ed:99:7e:0e:
ff:04:4b:52:e9:30:44:36:db:7e:0d:31:86:13:95:64:14:b4:
44:95:0a:c4:6f:13:06:c8:07:a4:13:fe:f8:eb:5b:27:44:b0:
26:71:97:b5:48:ba:73:1a:f4:53:65:bd:bd:cd:d5:5f:9b:64:
a8:ab:71:d0:9d:ad:a8:a0:fb:8f:a7:37:1d:f7:62:3e:a0:69:
7c:25:4a:fb:5d:3f:81:9f:7b:2a:40:0b:35:90:5b:47:8d:55:
36:c7:0f:8c:cb:53:62:f1:ae:5f:13:74:52:eb:dc:21:01:8f:
c6:6e:35:25:ae:2a:d1:60:9e:98:51:ca:2e:b8:0c:3c:00:db:
7c:a2:82:b2:97:71:99:78:77:84:8d:91:8e:de:5b:80:61:99:
70:c5:56:3f:12:e8:ff:e0**
Now, when I access a webserver which has the certificate signed by the intermediate CA ,the browser throws error saying the certificate is not valid the reason being in the Certificate Hierarchy root CA information is not there.
Please let me know if I am missing anything.
I am using a PositiveSSL certificate for my website www.movielee.com
Whenever I browse from my samsung S5 device,it shows
the security certificate of this site is expired
But never faced any kind of errors while browsing from PC.
Is that an issue with the intermediate certificate?
My browser and phone's time date settings are ok.
Using shared cPanel for the website.If there is a solution to get rid of this for shared hostings managed by cPanel,please let me know.
I am using a PositiveSSL certificate for my website
www.movielee.com Whenever I browse from my samsung S5 device,it shows
the security certificate of this site is expired
It appears the certificate is valid (see below). Make sure your Samsung's clock is set correctly.
Also make sure the CRLs associated with the certificate (and its chain) are valid. It looks like a new CRL was published around the time you asked the question:
$ curl http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl | \
openssl crl -inform DER -text -noout
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 139k 100 139k 0 0 661k 0 --:--:-- --:--:-- --:--:-- 795k
Certificate Revocation List (CRL):
Version 2 (0x1)
Signature Algorithm: sha256WithRSAEncryption
Issuer: /C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA
Last Update: Aug 25 00:39:57 2014 GMT
Next Update: Aug 29 00:39:57 2014 GMT
CRL extensions:
X509v3 Authority Key Identifier:
keyid:90:AF:6A:3A:94:5A:0B:D8:90:EA:12:56:73:DF:43:B4:3A:28:DA:E7
X509v3 CRL Number:
199
Revoked Certificates:
Serial Number: 07C977601B68FB2A2A061C2491521E5C
Revocation Date: Feb 20 19:10:49 2014 GMT
...
$ openssl s_client -connect www.movielee.com:443 | \
openssl x509 -text -noout
depth=1 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Domain Validation Secure Server CA
verify error:num=20:unable to get local issuer certificate
verify return:0
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
e6:c8:59:6a:3b:28:2c:ff:af:4c:82:ad:b6:61:d1:2f
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Secure Server CA
Validity
Not Before: Aug 14 00:00:00 2014 GMT
Not After : Aug 14 23:59:59 2015 GMT
Subject: OU=Domain Control Validated, OU=PositiveSSL, CN=movielee.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:d2:ca:25:8f:bb:f2:35:a1:12:a0:af:f7:f6:ef:
39:32:4e:e5:21:32:6d:d0:9a:fc:1f:f1:df:0d:eb:
78:65:11:81:57:9b:75:cb:e0:45:2c:d8:55:2f:5e:
f3:5e:42:b2:49:99:bb:90:8b:59:15:de:fa:14:9b:
cd:b9:d2:48:27:9c:6e:df:fe:16:76:26:d3:ed:f8:
63:37:53:47:14:92:51:96:5c:e0:5d:b3:33:71:af:
47:b6:45:8b:26:e4:99:b8:ea:1b:41:78:92:f2:ec:
c6:4e:87:c5:3c:26:31:1f:b6:d9:32:28:39:31:4b:
24:81:61:e2:1a:89:df:e5:cf:04:3a:d8:25:fd:2e:
00:77:99:95:16:77:a7:b9:cb:b4:67:2e:21:4a:48:
98:49:a8:7d:52:3d:48:a3:a0:46:c9:dd:34:72:57:
e3:50:49:cb:66:6f:fb:73:39:71:7f:cd:a7:73:56:
4e:87:1f:55:e9:a4:ab:7b:5e:69:78:1a:ba:8b:a1:
c9:df:f5:36:51:2d:f9:ba:a1:6d:51:4d:ce:b7:94:
43:6b:0b:8e:7e:cd:47:a9:2d:ff:fa:0f:c5:c2:f6:
09:cd:99:3a:a0:e0:5e:ed:e0:6c:7a:bf:5f:d1:46:
0b:c1:9f:80:2e:6b:bc:37:61:c9:23:4f:df:57:a4:
f2:ff
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Authority Key Identifier:
keyid:90:AF:6A:3A:94:5A:0B:D8:90:EA:12:56:73:DF:43:B4:3A:28:DA:E7
X509v3 Subject Key Identifier:
8E:9E:11:F1:21:88:CF:0F:01:80:3B:A4:60:76:B0:76:B1:B6:CA:19
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Certificate Policies:
Policy: 1.3.6.1.4.1.6449.1.2.1.3.4
CPS: https://secure.comodo.net/CPS
Policy: 2.23.140.1.2.1
X509v3 CRL Distribution Points:
Full Name:
URI:http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl
Authority Information Access:
CA Issuers - URI:http://crt.comodoca.com/COMODORSADomainValidationSecureServerCA.crt
OCSP - URI:http://ocsp.comodoca.com
X509v3 Subject Alternative Name:
DNS:movielee.com, DNS:www.movielee.com
Signature Algorithm: sha256WithRSAEncryption
8b:41:bf:20:da:b5:6a:8e:e9:88:a9:e2:3e:95:05:26:74:40:
8b:38:1e:3d:be:14:19:5c:38:dc:30:87:94:77:0c:85:8f:7e:
f3:a6:da:b5:3f:8f:2c:e5:90:bd:e4:f0:6a:20:22:98:6f:f7:
22:f8:3c:02:25:6b:a0:b6:9d:eb:1a:b2:a1:17:e5:67:2b:2a:
44:6f:37:70:59:a3:6f:9f:a7:32:50:49:ec:83:c0:4a:eb:65:
c0:c3:a8:36:42:d1:59:0a:3e:d0:1d:36:d4:75:92:0b:2b:ed:
a1:31:ca:b8:03:2b:44:91:e6:b2:7f:7b:01:dc:aa:c4:1d:cf:
a0:d4:c8:da:c7:d2:de:d7:4e:de:49:1f:86:87:c7:5b:1d:ed:
7f:dd:d0:c5:b2:16:fc:2c:54:13:5d:8e:02:e8:4c:c6:d1:1c:
46:f4:a1:6d:fc:75:d8:fc:0d:28:f2:3d:6d:ab:e5:f3:5f:56:
25:8b:9a:21:7a:46:b8:a9:eb:c9:a7:aa:30:a1:14:ec:be:65:
af:f7:40:bb:5b:a8:f5:31:e3:24:d0:a7:be:22:dd:a6:52:d0:
9f:30:56:9a:d8:d5:b2:f8:8b:ef:57:da:b4:e8:93:6b:67:25:
27:a7:9c:8b:c2:32:46:b0:de:46:67:13:b2:05:9b:be:e7:9b:
02:9f:22:f6