Fossil SCM

More descriptive SSL error messages.

bcsmith 2010-10-03 19:24 trunk
Commit 6b8b6d2e2395857aabf586024c6f4024faef8beb
Parent ae000c23fa01b1a…
1 file changed +133 -4
~ src/http_ssl.c
M src/http_ssl.c
+133 -4
--- src/http_ssl.c
+++ src/http_ssl.c
@@ -128,11 +128,12 @@
128128
 ** Return the number of errors.
129129
 */
130130
 int ssl_open(void){
131131
 X509 *cert;
132132
 int hasSavedCertificate = 0;
133
-char *connStr ;
133
+ char *connStr;
134
+ int vresult = 0;
134135
 ssl_global_init();
135136
136137
 /* Get certificate for current server from global config and
137138
 * (if we have it in config) add it to certificate store.
138139
 */
@@ -176,13 +177,14 @@
176177
 ssl_set_errmsg("No SSL certificate was presented by the peer");
177178
 ssl_close();
178179
 return 1;
179180
 }
180181
181
- if( SSL_get_verify_result(ssl) != X509_V_OK ){
182
+ if( (vresult = SSL_get_verify_result(ssl)) != X509_V_OK ){
182183
 char *desc, *prompt;
183184
 char *warning = "";
185
+ char *ssl_verify_error = "";
184186
 Blob ans;
185187
 BIO *mem;
186188
187189
 mem = BIO_new(BIO_s_mem());
188190
 X509_NAME_print_ex(mem, X509_get_subject_name(cert), 2, XN_FLAG_MULTILINE);
@@ -193,12 +195,139 @@
193195
194196
 if( hasSavedCertificate ){
195197
 warning = "WARNING: Certificate doesn't match the "
196198
 "saved certificate for this host!";
197199
 }
198
- prompt = mprintf("\nUnknown SSL certificate:\n\n%s\n\n%s\n"
199
- "Accept certificate [a=always/y/N]? ", desc, warning);
200
+ switch(vresult) {
201
+ case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
202
+ ssl_verify_error = "SSL: unable to get issuer certificate.";
203
+ break;
204
+
205
+ case X509_V_ERR_UNABLE_TO_GET_CRL:
206
+ ssl_verify_error = "SSL: unable to get certificate CRL.";
207
+ break;
208
+
209
+ case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE:
210
+ ssl_verify_error = "SSL: unable to decrypt certificate’s signature.";
211
+ break;
212
+
213
+ case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE:
214
+ ssl_verify_error = "SSL: unable to decrypt CRL’s signature.";
215
+ break;
216
+
217
+ case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY:
218
+ ssl_verify_error = "SSL: unable to decode issuer public key.";
219
+ break;
220
+
221
+ case X509_V_ERR_CERT_SIGNATURE_FAILURE:
222
+ ssl_verify_error = "SSL: certificate signature failure.";
223
+ break;
224
+
225
+ case X509_V_ERR_CRL_SIGNATURE_FAILURE:
226
+ ssl_verify_error = "SSL: CRL signature failure.";
227
+ break;
228
+
229
+ case X509_V_ERR_CERT_NOT_YET_VALID:
230
+ ssl_verify_error = "SSL: certificate is not yet valid.";
231
+ break;
232
+
233
+ case X509_V_ERR_CERT_HAS_EXPIRED:
234
+ ssl_verify_error = "SSL: certificate has expired.";
235
+ break;
236
+
237
+ case X509_V_ERR_CRL_NOT_YET_VALID:
238
+ ssl_verify_error = "SSL: CRL is not yet valid.";
239
+ break;
240
+
241
+ case X509_V_ERR_CRL_HAS_EXPIRED:
242
+ ssl_verify_error = "SSL: CRL has expired.";
243
+ break;
244
+
245
+ case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
246
+ ssl_verify_error = "SSL: format error in certificate’s notBefore field.";
247
+ break;
248
+
249
+ case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
250
+ ssl_verify_error = "SSL: format error in certificate’s notAfter field.";
251
+ break;
252
+
253
+ case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD:
254
+ ssl_verify_error = "SSL: format error in CRL’s lastUpdate field.";
255
+ break;
256
+
257
+ case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD:
258
+ ssl_verify_error = "SSL: format error in CRL’s nextUpdate field.";
259
+ break;
260
+
261
+ case X509_V_ERR_OUT_OF_MEM:
262
+ ssl_verify_error = "SSL: out of memory.";
263
+ break;
264
+
265
+ case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
266
+ ssl_verify_error = "SSL: self signed certificate.";
267
+ break;
268
+
269
+ case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
270
+ ssl_verify_error = "SSL: self signed certificate in certificate chain.";
271
+ break;
272
+
273
+ case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
274
+ ssl_verify_error = "SSL: unable to get local issuer certificate.";
275
+ break;
276
+
277
+ case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
278
+ ssl_verify_error = "SSL: unable to verify the first certificate.";
279
+ break;
280
+
281
+ case X509_V_ERR_CERT_CHAIN_TOO_LONG:
282
+ ssl_verify_error = "SSL: certificate chain too long.";
283
+ break;
284
+
285
+ case X509_V_ERR_CERT_REVOKED:
286
+ ssl_verify_error = "SSL: certificate revoked.";
287
+ break;
288
+
289
+ case X509_V_ERR_INVALID_CA:
290
+ ssl_verify_error = "SSL: invalid CA certificate.";
291
+ break;
292
+
293
+ case X509_V_ERR_PATH_LENGTH_EXCEEDED:
294
+ ssl_verify_error = "SSL: path length constraint exceeded.";
295
+ break;
296
+
297
+ case X509_V_ERR_INVALID_PURPOSE:
298
+ ssl_verify_error = "SSL: unsupported certificate purpose.";
299
+ break;
300
+
301
+ case X509_V_ERR_CERT_UNTRUSTED:
302
+ ssl_verify_error = "SSL: certificate not trusted.";
303
+ break;
304
+
305
+ case X509_V_ERR_CERT_REJECTED:
306
+ ssl_verify_error = "SSL: certificate rejected.";
307
+ break;
308
+
309
+ case X509_V_ERR_SUBJECT_ISSUER_MISMATCH:
310
+ ssl_verify_error = "SSL: subject issuer mismatch.";
311
+ break;
312
+
313
+ case X509_V_ERR_AKID_SKID_MISMATCH:
314
+ ssl_verify_error = "SSL: authority and subject key identifier mismatch.";
315
+ break;
316
+
317
+ case X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH:
318
+ ssl_verify_error = "SSL: authority and issuer serial number mismatch.";
319
+ break;
320
+
321
+ case X509_V_ERR_KEYUSAGE_NO_CERTSIGN:
322
+ ssl_verify_error = "SSL: key usage does not include certificate signing.";
323
+ break;
324
+ default:
325
+ ssl_verify_error = "SSL: Unknown error.";
326
+ };
327
+ prompt = mprintf("\nUnknown SSL certificate:\n\n%s\n\n%s\n%s Code: %d\n"
328
+ "Accept certificate [a=always/y/N]? ", desc, warning, ssl_verify_error, vresult);
200329
 BIO_free(mem);
201330
202331
 prompt_user(prompt, &ans);
203332
 free(prompt);
204333
 if( blob_str(&ans)[0]!='y' && blob_str(&ans)[0]!='a' ) {
205334
--- src/http_ssl.c
+++ src/http_ssl.c
@@ -128,11 +128,12 @@
128 ** Return the number of errors.
129 */
130 int ssl_open(void){
131 X509 *cert;
132 int hasSavedCertificate = 0;
133 char *connStr ;
 
134 ssl_global_init();
135
136 /* Get certificate for current server from global config and
137 * (if we have it in config) add it to certificate store.
138 */
@@ -176,13 +177,14 @@
176 ssl_set_errmsg("No SSL certificate was presented by the peer");
177 ssl_close();
178 return 1;
179 }
180
181 if( SSL_get_verify_result(ssl) != X509_V_OK ){
182 char *desc, *prompt;
183 char *warning = "";
 
184 Blob ans;
185 BIO *mem;
186
187 mem = BIO_new(BIO_s_mem());
188 X509_NAME_print_ex(mem, X509_get_subject_name(cert), 2, XN_FLAG_MULTILINE);
@@ -193,12 +195,139 @@
193
194 if( hasSavedCertificate ){
195 warning = "WARNING: Certificate doesn't match the "
196 "saved certificate for this host!";
197 }
198 prompt = mprintf("\nUnknown SSL certificate:\n\n%s\n\n%s\n"
199 "Accept certificate [a=always/y/N]? ", desc, warning);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
200 BIO_free(mem);
201
202 prompt_user(prompt, &ans);
203 free(prompt);
204 if( blob_str(&ans)[0]!='y' && blob_str(&ans)[0]!='a' ) {
205
--- src/http_ssl.c
+++ src/http_ssl.c
@@ -128,11 +128,12 @@
128 ** Return the number of errors.
129 */
130 int ssl_open(void){
131 X509 *cert;
132 int hasSavedCertificate = 0;
133 char *connStr;
134 int vresult = 0;
135 ssl_global_init();
136
137 /* Get certificate for current server from global config and
138 * (if we have it in config) add it to certificate store.
139 */
@@ -176,13 +177,14 @@
177 ssl_set_errmsg("No SSL certificate was presented by the peer");
178 ssl_close();
179 return 1;
180 }
181
182 if( (vresult = SSL_get_verify_result(ssl)) != X509_V_OK ){
183 char *desc, *prompt;
184 char *warning = "";
185 char *ssl_verify_error = "";
186 Blob ans;
187 BIO *mem;
188
189 mem = BIO_new(BIO_s_mem());
190 X509_NAME_print_ex(mem, X509_get_subject_name(cert), 2, XN_FLAG_MULTILINE);
@@ -193,12 +195,139 @@
195
196 if( hasSavedCertificate ){
197 warning = "WARNING: Certificate doesn't match the "
198 "saved certificate for this host!";
199 }
200 switch(vresult) {
201 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
202 ssl_verify_error = "SSL: unable to get issuer certificate.";
203 break;
204
205 case X509_V_ERR_UNABLE_TO_GET_CRL:
206 ssl_verify_error = "SSL: unable to get certificate CRL.";
207 break;
208
209 case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE:
210 ssl_verify_error = "SSL: unable to decrypt certificate’s signature.";
211 break;
212
213 case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE:
214 ssl_verify_error = "SSL: unable to decrypt CRL’s signature.";
215 break;
216
217 case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY:
218 ssl_verify_error = "SSL: unable to decode issuer public key.";
219 break;
220
221 case X509_V_ERR_CERT_SIGNATURE_FAILURE:
222 ssl_verify_error = "SSL: certificate signature failure.";
223 break;
224
225 case X509_V_ERR_CRL_SIGNATURE_FAILURE:
226 ssl_verify_error = "SSL: CRL signature failure.";
227 break;
228
229 case X509_V_ERR_CERT_NOT_YET_VALID:
230 ssl_verify_error = "SSL: certificate is not yet valid.";
231 break;
232
233 case X509_V_ERR_CERT_HAS_EXPIRED:
234 ssl_verify_error = "SSL: certificate has expired.";
235 break;
236
237 case X509_V_ERR_CRL_NOT_YET_VALID:
238 ssl_verify_error = "SSL: CRL is not yet valid.";
239 break;
240
241 case X509_V_ERR_CRL_HAS_EXPIRED:
242 ssl_verify_error = "SSL: CRL has expired.";
243 break;
244
245 case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
246 ssl_verify_error = "SSL: format error in certificate’s notBefore field.";
247 break;
248
249 case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
250 ssl_verify_error = "SSL: format error in certificate’s notAfter field.";
251 break;
252
253 case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD:
254 ssl_verify_error = "SSL: format error in CRL’s lastUpdate field.";
255 break;
256
257 case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD:
258 ssl_verify_error = "SSL: format error in CRL’s nextUpdate field.";
259 break;
260
261 case X509_V_ERR_OUT_OF_MEM:
262 ssl_verify_error = "SSL: out of memory.";
263 break;
264
265 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
266 ssl_verify_error = "SSL: self signed certificate.";
267 break;
268
269 case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
270 ssl_verify_error = "SSL: self signed certificate in certificate chain.";
271 break;
272
273 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
274 ssl_verify_error = "SSL: unable to get local issuer certificate.";
275 break;
276
277 case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
278 ssl_verify_error = "SSL: unable to verify the first certificate.";
279 break;
280
281 case X509_V_ERR_CERT_CHAIN_TOO_LONG:
282 ssl_verify_error = "SSL: certificate chain too long.";
283 break;
284
285 case X509_V_ERR_CERT_REVOKED:
286 ssl_verify_error = "SSL: certificate revoked.";
287 break;
288
289 case X509_V_ERR_INVALID_CA:
290 ssl_verify_error = "SSL: invalid CA certificate.";
291 break;
292
293 case X509_V_ERR_PATH_LENGTH_EXCEEDED:
294 ssl_verify_error = "SSL: path length constraint exceeded.";
295 break;
296
297 case X509_V_ERR_INVALID_PURPOSE:
298 ssl_verify_error = "SSL: unsupported certificate purpose.";
299 break;
300
301 case X509_V_ERR_CERT_UNTRUSTED:
302 ssl_verify_error = "SSL: certificate not trusted.";
303 break;
304
305 case X509_V_ERR_CERT_REJECTED:
306 ssl_verify_error = "SSL: certificate rejected.";
307 break;
308
309 case X509_V_ERR_SUBJECT_ISSUER_MISMATCH:
310 ssl_verify_error = "SSL: subject issuer mismatch.";
311 break;
312
313 case X509_V_ERR_AKID_SKID_MISMATCH:
314 ssl_verify_error = "SSL: authority and subject key identifier mismatch.";
315 break;
316
317 case X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH:
318 ssl_verify_error = "SSL: authority and issuer serial number mismatch.";
319 break;
320
321 case X509_V_ERR_KEYUSAGE_NO_CERTSIGN:
322 ssl_verify_error = "SSL: key usage does not include certificate signing.";
323 break;
324 default:
325 ssl_verify_error = "SSL: Unknown error.";
326 };
327 prompt = mprintf("\nUnknown SSL certificate:\n\n%s\n\n%s\n%s Code: %d\n"
328 "Accept certificate [a=always/y/N]? ", desc, warning, ssl_verify_error, vresult);
329 BIO_free(mem);
330
331 prompt_user(prompt, &ans);
332 free(prompt);
333 if( blob_str(&ans)[0]!='y' && blob_str(&ans)[0]!='a' ) {
334

Keyboard Shortcuts

Open search /
Next entry (timeline) j
Previous entry (timeline) k
Open focused entry Enter
Show this help ?
Toggle theme Top nav button