Chrome Reject certificate generated by MBEDTLS

185 views Asked by At

I am using mbedtls 2.16.3 . I use mbedtls library to create two level certificate and use the certificate to set up https communication. The root certification(also be CA) is a self-signed certificate using ECC secp256r1. The device certification is signed by the root certificate, and the key algorithm is also ECC secp256r1. I install the root certification in the OS system and Firefox certification manager. Chrome will show “Certificate Unknown” after receiving the certificate(The chrome version is 86.0.4240.75)

The wireshark shows as followings: Wireshark caption

The chrome shows as followings:

NET::ERR_CERT_INVALID Subject: 10.9.1.67 Issuer: Web Server Root Expires on: 2021/10/13 Current date: 2020/10/19 PEM encoded chain:

-----BEGIN CERTIFICATE----- MIIBejCCAR6gAwIBAgISANm85JYVS9N1992FvOfHxhsAMAwGCCqGSM49BAMCBQAw JzELMAkGA1UEBhMCQ04xGDAWBgNVBAMMD1dlYiBTZXJ2ZXIgUm9vdDAeFw0yMDEw MTYwMTIzMTdaFw0yMTEwMTMwMjQyNDRaMCExCzAJBgNVBAYTAkNOMRIwEAYDVQQD DAkxMC45LjEuNjcwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATdpywNJKmMvDr2 esvqe9CVhjhQDgzzUo6WhMD91CosNJhkDtkMAbexQkq/je6IQyZABxFkiDMweLWe uJR3rTbNoy4wLDAPBgNVHREECDAGhwQKCQFDMAkGA1UdEwQCMAAwDgYDVR0PAQH/ BAQDAgOoMAwGCCqGSM49BAMCBQADSAAwRQIgPRgDnfR7NIXfUlvaUyDtsIJDUGV2 BFKf7wxElxfbKDICIQDpVu5Ty9tZznQeuch+5LV0vDqXm6EWg+Viv6w5O59QIg== -----END CERTIFICATE-----

-----BEGIN CERTIFICATE----- MIIBdDCCARigAwIBAgIRfRupqU8vSJw2LfGv1LSuXwAwDAYIKoZIzj0EAwIFADAn MQswCQYDVQQGEwJDTjEYMBYGA1UEAwwPV2ViIFNlcnZlciBSb290MB4XDTIwMTAx NjA5MjMxNloXDTQwMTAxNjA5MjMxNlowJzELMAkGA1UEBhMCQ04xGDAWBgNVBAMM D1dlYiBTZXJ2ZXIgUm9vdDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABMZaKSeR hoDgIeVbNkBYY0/n7z4JD+y+bZBXuDsFzYbz4odAe2C3WxpJ7fUw6sOCs1jpy8mv neV1sRH3KXEXqNOjIzAhMA8GA1UdEwQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgKE MAwGCCqGSM49BAMCBQADSAAwRQIgPa8BVP5Bt2YLQ3DHEbGsg79nJbtTSAKmAPaa 5NLEIEcCIQCENcnKEdTKV0L/1c3evynH/hP97mid58trLgBRlFU3Dw== -----END CERTIFICATE-----

But the certification works well on Firefox/Edge.

And if I change the self-signed certificate to RSA 1024, the https connection in Chrome is okay.

1

There are 1 answers

0
Shawn Nolan On

There is a very quick fix to this issue. In function: mbedtls_asn1_write_algorithm_identifier of asn1write.cpp, just delete this line of code:MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_null( p, start ) );