Expired self-issued certificate has different chain building status on Linux

[heng-liu]

Description

If we build the chain for the expired self-issued certificate (add it to trusted store before it expires) by setting the policy as following:

         ChainPolicy.VerificationFlags = X509VerificationFlags.IgnoreNotTimeValid;
         ChainPolicy.RevocationMode = X509RevocationMode.Online;
         ChainPolicy.RevocationFlag = X509RevocationFlag.ExcludeRoot;
         ChainPolicy.VerificationTime = DateTime.Now;

The chain build on Linux is different from other platforms:
Chain status: "NotTimeValid,RevocationStatusUnknown,UntrustedRoot"
While on Windows the chain build is successful.

But if we build the chain for the expired leaf certificate issued by intermediate CA by using the same policy setting,
the chain build is successful for both Linux and Windows.

Configuration

• Which version of .NET is the code running on?
  .NET 5
• What OS and version, and what distro if applicable?
  Linux, Ubuntu 18.08

Regression?

I'm not sure

Other information

Repro steps:

1. On Windows, git clone https://github.com/NuGet/Entropy.git
2. On Windows, type "powershell" and cd <path_to_Entropy>\ TestCertGenerator.
3. On Windows，create a new test certificate: .\CreateTestCertificate.ps1 -AddAsTrustedRootAuthority -NotAfter "<10 minutes in the future from current local time>" -GenerateCerFile
4. Copy the .cer file(is generated in step 3) from the above Windows machine to Linux machine. (before the certificate expires)
5. On Linux, change the .cer to .crt format: (before the certificate expires)
   openssl x509 -inform DER -in <.cer file path> -out <.crt file path>
6. On Linux, add the certificate(.crt) to trusted store: (before the certificate expires)

      cd /usr/local/share/ca-certificates/
      sudo cp <.crt file path>  ./  
      sudo chmod 644 ./<.crt file name> 
      sudo update-ca-certificates

7. On Linux, run chain build with following settings on policy

         ChainPolicy.VerificationFlags = X509VerificationFlags.IgnoreNotTimeValid;
         ChainPolicy.RevocationMode = X509RevocationMode.Online;
         ChainPolicy.RevocationFlag = X509RevocationFlag.ExcludeRoot;
         ChainPolicy.VerificationTime = DateTime.Now;

8. The chain status is: "NotTimeValid,RevocationStatusUnknown,UntrustedRoot" on Linux but good on Windows.

If we change it into an expired leaf cert issued by intermediate CA, the chain build result will be good.
Attached are the certs from leaf to root:
certifaicates.zip

[ghost]

Tagging subscribers to this area: @bartonjs, @vcsjones, @krwq, @GrabYourPitchforks
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Description

If we build the chain for the expired self-issued certificate (add it to trusted store before it expires) by setting the policy as following:

         ChainPolicy.VerificationFlags = X509VerificationFlags.IgnoreNotTimeValid;
         ChainPolicy.RevocationMode = X509RevocationMode.Online;
         ChainPolicy.RevocationFlag = X509RevocationFlag.ExcludeRoot;
         ChainPolicy.VerificationTime = DateTime.Now;

The chain build on Linux is different from other platforms:
Chain status: "NotTimeValid,RevocationStatusUnknown,UntrustedRoot"
While on Windows the chain build is successful.

But if we build the chain for the expired leaf certificate issued by intermediate CA by using the same policy setting,
the chain build is successful for both Linux and Windows.

Configuration

• Which version of .NET is the code running on?
  .NET 5
• What OS and version, and what distro if applicable?
  Linux, Ubuntu 18.08

Regression?

I'm not sure

Other information

Repro steps:

1. On Windows, git clone https://github.com/NuGet/Entropy.git
2. On Windows, type "powershell" and cd <path_to_Entropy>\ TestCertGenerator.
3. On Windows，create a new test certificate: .\CreateTestCertificate.ps1 -AddAsTrustedRootAuthority -NotAfter "<10 minutes in the future from current local time>" -GenerateCerFile
4. Copy the .cer file(is generated in step 3) from the above Windows machine to Linux machine. (before the certificate expires)
5. On Linux, change the .cer to .crt format: (before the certificate expires)
   openssl x509 -inform DER -in <.cer file path> -out <.crt file path>
6. On Linux, add the certificate(.crt) to trusted store: (before the certificate expires)

      cd /usr/local/share/ca-certificates/
      sudo cp <.crt file path>  ./  
      sudo chmod 644 ./<.crt file name> 
      sudo update-ca-certificates

7. On Linux, run chain build with following settings on policy

         ChainPolicy.VerificationFlags = X509VerificationFlags.IgnoreNotTimeValid;
         ChainPolicy.RevocationMode = X509RevocationMode.Online;
         ChainPolicy.RevocationFlag = X509RevocationFlag.ExcludeRoot;
         ChainPolicy.VerificationTime = DateTime.Now;

8. The chain status is: "NotTimeValid,RevocationStatusUnknown,UntrustedRoot" on Linux but good on Windows.

If we change it into an expired leaf cert issued by intermediate CA, the chain build result will be good.
Attached are the certs from leaf to root:
certifaicates.zip

Author:	heng-liu
Assignees:	-
Labels:	area-System.Security, untriaged
Milestone:	-

[vcsjones]

The issue seems to be UntrustedRoot I saw this step here:

On Linux, add the certificate(.crt) to trusted store

But given that it's reporting UntrustedRoot, that is likely why the chain is not building.

As for NotTimeValid, note that even if Build returns true, but you used verification flags to suppress an error, it will still be reported in the chain element status. I noticed this in #38005 (comment) and that seems to be "working as expected".

[heng-liu]

On Linux:
For expired leaf certificate issued by intermediate CA, the chain building is successful.
For expired self-issued certificate,
before it expires, the chain status is "RevocationStatusUnknown"
after it expires, the chain status is "NotTimeValid,RevocationStatusUnknown,UntrustedRoot"

[bartonjs]

Seems like we're treating the (about to be ignored) NotTimeValid as a reason to not do revocation processing, but that Windows' logic doesn't quite match there.

There's probably room for improvement, but I don't think there's a compelling scenario to drive this for 6.0.

[jherby2k]

Is this why i'm throwing exceptions when I try to "nuget sign" with a self-signed PFX on Linux? Works on Windows and Mac just fine. Tried doing nuget config -set signaturevalidationmode=accept but it made no difference.

error: NU3018: PartialChain: unable to get local issuer certificate
error: NU3018: Certificate chain validation failed.

If so, any suggested workaround? Other than copying the files over to Windows I mean :) Trying to do this via CI.

[virzak]

This would be an awesome fix for .net 8, since it allows library maintainers to sign their packages on ubuntu-latest which is much faster than windows-latest