OpenSSL s_client returns unsupported certificate purpose on one machine but works normally on another with same certificates

Question

I'm debugging TLS connection issue between host and docker container. My docker container has a server certificate:

This certificate is issued by CA with following certificate:

When i run s_client on host machine:

$ openssl s_client -CAfile ./ca.crt -connect localhost:7051 -servername insurance-peer

It returns

 SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-ECDSA-AES256-GCM-SHA384
    Session-ID:
    Session-ID-ctx:
    Master-Key: 94B93D75B297584B53E87ADA0968F2B3B9121F1CAA048212642195E299F6BEA24E482E19E35F5FF18D596E138955EEBF
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1571897582
    Timeout   : 7200 (sec)
    Verify return code: 26 (unsupported certificate purpose)
    Extended master secret: no

Note that the return code is 26 (unsupported certificate purpose)

When I run s_client on docker container

$ openssl s_client -connect insurance-peer:7051 -CAfile ./ca.crt

It returns:

SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-ECDSA-AES256-GCM-SHA384
    Session-ID:
    Session-ID-ctx:
    Master-Key:85B6CAD935415FFDCC76623E9A1B5FC1749D3B7B450B41316F581A181D29039CA092B55F25170ED8D125B7ACFBE33289
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1571897694
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)

Note that return code here is 0 (ok)

So in case of s_client connection between host and container the error is unsupported certificate purpose while in case of connection within the container it works normally.

$ openssl verify works ok in both environments.

Host:

$ openssl verify -CAfile ./ca.crt server.crt
server.crt: OK

Docker:

# openssl verify -CAfile ./ca.crt server.crt
server.crt: OK

OpenSSL version on host machine: OpenSSL 1.1.1d 10 Sep 2019

OpenSSL version on docker: OpenSSL 1.0.2g 1 Mar 2016

Can you please assist me what can be the issue here?

Looks similar to this bug report: https://trac.nginx.org/nginx/ticket/1760#comment:5 . Your CA key reports "Any Extended Key Usage". It is supported since OpenSSL 1.1.0. This is why different versions behave differently. To fix, I feel, you need to update OpenSSL. — Nikita Kipriyanov, Oct 24 '19 at 07:11
@NikitaKipriyanov yeah looks like it. It is reproduced with `openssl verify -CAfile ./ca.crt -purpose sslclient ./server.crt`. Many thanks. Would you post this as an answer so I can accept? — paulus, Oct 24 '19 at 07:14

score 1 · Accepted Answer · answered Oct 24 '19 at 07:16

1

Looks similar to this bug report: Nginx #1760.

Your CA key reports "Any Extended Key Usage". It is supported since OpenSSL 1.1.0. This is why different versions behave differently. To fix, I feel, you need to update OpenSSL.

answered Oct 24 '19 at 07:16

Nikita Kipriyanov

10,947
2
24
45

OpenSSL s_client returns unsupported certificate purpose on one machine but works normally on another with same certificates

1 Answers1