Bug 912610

Summary:	OpenSSL version 1.0.1 does not support certificates created by older version stored in trust_store.
Product:	[Other] Security Response	Reporter:	Sushil Sharma <sushil_sharma>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	unspecified
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	All
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-02-19 11:41:33 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Sushil Sharma 2013-02-19 07:53:01 UTC

Description of problem:
We have upgraded openssl from 0.9.8 to 1.0.1 and have found problem while trying to verify the certificate which was created using libraries of version 0.9.8. 
The verify command fails due to which client validation using the same certificate fails.

netqf140:/etc/opt/ibm/icc/truststore # /opt/ibm/icc/bin/openssl version
WARNING: can't open config file: /usr/local/ssl/openssl.cnf
OpenSSL 1.0.1 14 Mar 2012
netqf140:/etc/opt/ibm/icc/truststore # /opt/ibm/icc/bin/openssl version
WARNING: can't open config file: /usr/local/ssl/openssl.cnf
OpenSSL 1.0.1 14 Mar 2012
netqf140:/etc/opt/ibm/icc/truststore # openssl version
OpenSSL 0.9.8h 28 May 2008
netqf140:/etc/opt/ibm/icc/truststore # ll
total 12
-rw------- 1 root root 981 Feb 18 05:22 a533da62.0
-rw------- 1 root root 977 Jan 11 05:17 aaada30a.0
-rw------- 1 root root 973 Jan 21 12:16 adcfb619.0
netqf140:/etc/opt/ibm/icc/truststore # /opt/ibm/icc/bin/openssl verify -CApath /etc/opt/ibm/icc/truststore a533da62.0
WARNING: can't open config file: /usr/local/ssl/openssl.cnf
a533da62.0: C = US, ST = NC, L = RTP, O = Director Development, OU = IBM Corporation, CN = IBM Director on 10.12.200.214 1327360788187
error 18 at 0 depth lookup:self signed certificate
OK
netqf140:/etc/opt/ibm/icc/truststore # openssl verify -CApath /etc/opt/ibm/icc/truststore a533da62.0
a533da62.0: OK
netqf140:/etc/opt/ibm/icc/truststore #

Version-Release number of selected component (if applicable):
Problem seen with OpenSSL 1.0.1.
Old version : OpenSSL 0.9.8h

Same issue is seen if steps are vica-versa.

How reproducible:
Create a x-509 certificate using 0.9.8 and store it in truststore, upgrade Openssl and verify the old certificate using verify command. 
Error no 18 is seen for self signed certificate.


Steps to Reproduce:
1. Create a x509 certificate and save the hash file in truststore.
2. upgrade openssl to 1.0.1
3. try to verify certificate using verifycommand and specify -CApath as truststore path.
  
Actual results:

netqf140:/etc/opt/ibm/icc/truststore # /opt/ibm/icc/bin/openssl verify -CApath /etc/opt/ibm/icc/truststore a533da62.0
WARNING: can't open config file: /usr/local/ssl/openssl.cnf
a533da62.0: C = US, ST = NC, L = RTP, O = Director Development, OU = IBM Corporation, CN = IBM Director on 10.12.200.214 1327360788187
error 18 at 0 depth lookup:self signed certificate
OK

Expected results:
Error should not be reported during verify command.

Additional info:

Comment 1 Tomas Hoger 2013-02-19 11:41:33 UTC

This is not a security bug, the report is for random custom build not supported by Red Hat, and it actually is not even a bug.  Closing.

Hint: try running something like this with both versions:
$ openssl x509 -in a533da62.0 -noout -hash