OpenSSL: certificate signature failure error

13,657

The problem disappared. Probably some update fixed it.

Share:
13,657

Related videos on Youtube

Etienne Dechamps
Author by

Etienne Dechamps

Updated on September 17, 2022

Comments

  • Etienne Dechamps
    Etienne Dechamps over 1 year

    I'm trying to wget La Banque Postale's website.

    $ wget https://www.labanquepostale.fr/
    --2009-10-08 17:25:03--  https://www.labanquepostale.fr/
    Resolving www.labanquepostale.fr... 81.252.54.6
    Connecting to www.labanquepostale.fr|81.252.54.6|:443... connected.
    ERROR: cannot verify www.labanquepostale.fr's certificate, issued by `/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)06/CN=VeriSign Class 3 Extended Validation SSL SGC CA':
      certificate signature failure
    To connect to www.labanquepostale.fr insecurely, use `--no-check-certificate'.
    Unable to establish SSL connection.
    

    I'm using Debian Sid. On another machine which is running Debian Sid with same software versions the command works perfectly. ca-certificates is installed on both machines (I tried removing it and reinstalling it in case a certificate got corrupted somehow, no luck).

    Opening https://www.labanquepostale.fr/ in Iceweasel on the same machine works perfectly.

    Additional information:

    $ openssl s_client -CApath /etc/ssl/certs -connect www.labanquepostale.fr:443
    CONNECTED(00000003)
    depth=3 /C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority
    verify error:num=7:certificate signature failure
    verify return:0
    ---
    Certificate chain
     0 s:/1.3.6.1.4.1.311.60.2.1.3=FR/2.5.4.15=V1.0, Clause 5.(b)/serialNumber=421100645/C=FR/postalCode=75006/ST=PARIS/L=PARIS/streetAddress=115 RUE DE SEVRES/O=LA BANQUE POSTALE/OU=DISF2/CN=www.labanquepostale.fr
       i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)06/CN=VeriSign Class 3 Extended Validation SSL SGC CA
     1 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)06/CN=VeriSign Class 3 Extended Validation SSL SGC CA
       i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5
     2 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5
       i:/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority
     3 s:/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority
       i:/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority
    ---
    Server certificate
    -----BEGIN CERTIFICATE-----
    <base64-encoded certificate removed for lisibility>
    -----END CERTIFICATE-----
    subject=/1.3.6.1.4.1.311.60.2.1.3=FR/2.5.4.15=V1.0, Clause 5.(b)/serialNumber=421100645    /C=FR/postalCode=75006/ST=PARIS/L=PARIS/streetAddress=115 RUE DE SEVRES/O=LA BANQUE POSTALE/OU=DISF2/CN=www.labanquepostale.fr
    issuer=/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)06/CN=VeriSign Class 3 Extended Validation SSL SGC CA
    ---
    No client certificate CA names sent
    ---
    SSL handshake has read 5101 bytes and written 300 bytes
    ---
    New, TLSv1/SSLv3, Cipher is RC4-MD5
    Server public key is 1024 bit
    Compression: NONE
    Expansion: NONE
    SSL-Session:
        Protocol  : TLSv1
        Cipher    : RC4-MD5
        Session-ID: 0009008CB3ADA9A37CE45B464E989C82AD0793D7585858584ACE056700035363
        Session-ID-ctx: 
        Master-Key: 1FB7DAD98B6738BEA7A3B8791B9645334F9C760837D95E3403C108058A3A477683AE74D603152F6E4BFEB6ACA48BC2C3
        Key-Arg   : None
        Start Time: 1255015783
        Timeout   : 300 (sec)
        Verify return code: 7 (certificate signature failure)
    ---
    

    Any idea why I get certificate signature failure? As if this wasn't strange enough, copy-pasting the "server certificate" mentionned in the output and running openssl verify on it returns OK...