Bugs item #3573889, was opened at 2012-10-02 12:11
Message generated for change (Comment added) made by bagder
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=100976&aid=3573889&group_id=976

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: https
Group: bad behaviour
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Morac (mkraft)
Assigned to: Daniel Stenberg (bagder)
Summary: BADCERT_CN_MISMATCH for valid certificate

Initial Comment:
I'm trying to access https://www.wd2go.com. The certificate is valid and the chain goes from *.wd2go.com to "DigiCert High Assurance CA-3" to "DigiCert High Assurance EV Root CA" to "GTE CyberTrust Global Root". I'm using the http://curl.haxx.se/ca/cacert.pem certificate file. In curl 7.27.0 this results in a BADCERT_CN_MISMATCH error. It works fine under curl 7.23.1.

The web site loads fine in Firefox. I do notice that the "DigiCert High Assurance EV Root CA" certificate in Firefox does not match the one in cacert.pem. It didn't work when I added the Firefox certificate to the cacert.pem file. It didn't even work, when I added the *.wd2go.com certificate to that file.

Again curl 7.23.1 works, 7.27.0 does not.

The output for curl 7.27.0 is:

* About to connect() to www.wd2go.com port 443 (#0)
* Trying 198.107.148.110...
* connected
* Connected to www.wd2go.com (198.107.148.110) port 443 (#0)
* PolarSSL: Connecting to www.wd2go.com:443
* PolarSSL: Handshake complete, cipher is SSL-RSA-RC4-128-MD5
* Cert verify failed: BADCERT_CN_MISMATCH
* Closing connection #0
curl: (51) Cert verify failed: BADCERT_CN_MISMATCH

----------------------------------------------------------------------

>Comment By: Daniel Stenberg (bagder)
Date: 2012-10-02 13:49

Message:
Are you using the same SSL library (and version) with both curl versions?
If so, which PolarSSL version are you using?

----------------------------------------------------------------------

You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=100976&aid=3573889&group_id=976
Received on 2012-10-02