getting certificate error when trying to connect t...

kb1 · ‎2020-10-28

So we are trying to connect to a proofpoint link for employee training-

https://004e0b01.pphosted.com:10000/

and we can connect to it from home when not connected to company vpn, but when we are inside the network it doesnt work, i have tried the following straight from the internet firewall (running GAiA R80.20) and this is what i got-

[Expert@VXX-FWXX:0]# curl_cli -v https://004e0b01.pphosted.com:10000/
* Trying 205.220.162.242...
* Connected to 004e0b01.pphosted.com (205.220.162.242) port 10000 (#0)
* ALPN, offering http/1.1
* Cipher selection: HIGH:!RC4:!LOW:!EXP:!aNULL:!SSLv2:!MD5:!aECDH:!EDH
* *** Current date is: Wed Oct 28 14:46:31 2020
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* err is -1, detail is 2
* *** Current date is: Wed Oct 28 14:46:31 2020
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS alert, Server hello (2):
* err is -1, detail is 1
* errdetail=0x14090086
ERR_lib_error_string: SSL routines
ERR_func_error_string: ssl3_get_server_certificate
ERR_reason_error_string: certificate verify failed
ERR_error_string: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.

As you can see from the above output the connection to the server itself is successful but towards the end there is cert error because of which connection is being dropped, i dont think this is a firewall issue (we have url filtering enabled but not https inpsection, using only categoized https inspection), so im assuming that this is not an issue from our side?

Thank You.

_Val_ · ‎2020-10-29

It looks like you cannot fetch CRL.

Also, are you using inbonud HTTPS Inspection?

kb1 · ‎2020-10-29

as you can see https inspection is turned off, only categorized https inspection is enabled which i dont think should be causing any cert issues unless im wrong-

_Val_ · ‎2020-11-01

With R80.20, starting from certain HFA, HTTPS categorisation verifies the actual web certificate, CRL and its chain. Please make sure the following:

Web site you are accessing has a trusted certificate
Security GW has DNS working properly
CRL can be retrieved

If at least one condition does not match, that's your case:

ERR_lib_error_string: SSL routines
ERR_func_error_string: ssl3_get_server_certificate
ERR_reason_error_string: certificate verify failed
ERR_error_string: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate

kb1 · ‎2020-11-02

How can I make sure that the crl can be retrieved?

_Val_ · ‎2020-11-02

Did you already rule out two first cases? Can you access this website from a non-firewalled client? How does the certificate look?

CRL distribution point is mentioned in the certificate itself. Take this URL and try accessing it from the GW, with curl_cli

kb1 · ‎2020-11-02

So apparently it works with the untrusted option as you can see below, what does that mean?

[Expert@VXX-FXX:0]# curl_cli -k https://004e0b01.pphosted.com:10000/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="https://004e0b01.pphosted.com:10000/admin">here</a>.</p>
</body></html>

PhoneBoy · ‎2020-10-31

Looks like curl isn’t trusting the certificate presented.
Have you tried using the —insecure option as noted in the output?

kb1 · ‎2020-11-02

Yes I will try that out and post here

kb1 · ‎2020-11-02

So apparently it works with the untrusted option as you can see below, what does that mean?

curl_cli -k https://004e0b01.pphosted.com:10000/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="https://004e0b01.pphosted.com:10000/admin">here</a>.</p>
</body></html>

_Val_ · ‎2020-11-02

I think the best is to open a support call. I can see, the certificate is valid, but CRL is not hosted on digicert but on a different site: http://cacerts.thawte.com/ThawteRSACA2018.crt

This might be the source of your issue, or, it might be something else. BTW, check you can fetch http://cacerts.thawte.com/ThawteRSACA2018.crt from your GW.

kb1 · ‎2020-11-05

ok thanks for the help.

kb1 · ‎2020-11-05

i tried this-

curl_cli -v http://cacerts.thawte.com/ThawteRSACA2018.crt

and got a binary output and im assuming its able to fetch the cert?

Are you a member of CheckMates?

getting certificate error when trying to connect to a site