<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">certs and keys and PKI, oh my! <br>
<br>
<br>
On 07/12/2016 05:01 PM, Rob Funk wrote:<br>
</div>
<blockquote cite="mid:20160712210109.GA16875@funknet.net"
type="cite">
<pre wrap=""> openssl s_client -connect <a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="http://www.hpc.mil:443">www.hpc.mil:443</a>
</pre>
</blockquote>
<br>
Yet another handy incantation of '<font face="Courier New, Courier,
monospace">openssl</font>'. Thanks Rob! Making a note of that one.
<br>
<br>
<br>
<blockquote cite="mid:20160712210109.GA16875@funknet.net"
type="cite">
<pre wrap="">Shows me this certificate chain:
0 s:/C=US/O=U.S. Government/OU=DoD/OU=PKI/OU=OSD/CN=www.hpc.mil
i:/C=US/O=U.S. Government/OU=DoD/OU=PKI/CN=DOD CA-28
1 s:/C=US/O=U.S. Government/OU=DoD/OU=PKI/CN=DOD CA-28
i:/C=US/O=U.S. Government/OU=DoD/OU=PKI/CN=DoD Root CA 2
2 s:/C=US/O=U.S. Government/OU=DoD/OU=PKI/CN=DoD Root CA 2
i:/C=US/O=U.S. Government/OU=DoD/OU=PKI/CN=DoD Root CA 2
That last one is self-signed. Most likely the people who use such
sites often are set up to accept it.</pre>
</blockquote>
<br>
Quite. <br>
Last one calls itself a "root". <br>
Root PKI certs are always self signed. <br>
Root PKI certs only work when they are pre-loaded into the trust
store (e.g., of your browser). <br>
<br>
Have been doing a lot of customer hand-holding lately on exactly
this issue. <br>
<br>
<br>
<blockquote cite="mid:20160712210109.GA16875@funknet.net"
type="cite">
<pre wrap="">(When I look at it in Firefox I get an Unknown Issuer error.)</pre>
</blockquote>
<br>
Which is exactly right. FF is simply saying that the final cert in
that chain is not in its brain. <br>
<br>
This is all a matter of trust. <br>
<br>
PKI is a cathedral model. Dotmil sites do their own thing. (They
don't outsource to Verisign or whomever. And they can mangle their
own PCs on their own terms.) Same thing happens with big companies:
server certs for internal sites may be issued by an internal CA. The
root cert(s) for that internal CA must be pre-loaded into the
Windoze trust thingy. (Which is what IE will use. FF and Chrome are
more traditional, but your corporate IT people know how to fix those
... if they care.) The PKI model requires one or more "cathedrals"
where you go for blessing. PGP/GPG is more lay-minister kind of
thing. (We can bless each other, thank you very much. Or get blessed
at the bazaar ... er, uh ... key signing party.) <br>
<br>
It's not rocket surgery, but it's also not common knowledge. Maybe a
COLUG topic? <br>
<br>
-- R; <><<br>
<br>
<br>
<br>
</body>
</html>