keybase / keybase/keybase-issues
HTTPS verification requires more intermediate certificates than web browsers do
- Dominant language
- No language data
- Stars
- 899
- Forks
- 40
- PR merge metrics
- No merged PRs in 30d
Description
My site (pornel.net) has certificate signed by:
1. 2048bit "AddTrust External CA Root" (02faf3e291435468607857694df5e45b68851868) and
2. 4096bit "USERTrust RSA Certification Authority" (2b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e)
It appears that when checking HTTPS proofs keybase.io only trusts the first one, but not the second one and doesn't download intermediate certificates.
My proof couldn't be verified until I made my server send an intermediate certificate for "USERTrust RSA Certification Authority" (eab040689a0d805b5d6fd654fc168cff00b78be3).
Common web browsers don't seem to require that intermediate certificate, so it would be nice if keybase.io didn't need it either, so I could avoid sending extra certs.
Also, the site is very vague about this error: #1510.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by locating the Keybase HTTPS proof-verification logic and reviewing the related error in issue #1510. Compare its certificate-chain handling with the browser behavior described here; done means valid proofs work without requiring the extra intermediate certificate and the failure message is less vague.
Written by the indexing model from the issue text.
Assessment
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100