Comments (5)
Thanks for the test and the complete description of your setup! Based on this, two questions:
Since the root certificate has been installed and the verification of root certificate - intermediate certificate chain doesn't require any OQS-enabled library, the website should be accessible in Chromium.
Why are you expecting this? Chromium ought to verify the whole cert chain, incl. the dilithium-site cert and not just the "last step". Hence #92 (and the errors shown) are to be expected, as there is a QSC alg involved, right?
We further found that Chromium failed to verify the root certificate - intermediate certificate chain, but it succeeded in verifying the intermediate certificate - leaf certificate chain.
How did you come to this conclusion/what test did you do? I would actually expect the exact opposite: The intermediate cert could/should be verifiable with classic crypto while the site/leaf->intermediate cert needing QSC should not be as per #92.
from oqs-demos.
The intermediate cert could/should be verifiable with classic crypto while the site/leaf->intermediate cert needing QSC should not be as per #92.
I've thought about this reason. What is really confusing is that there is no root certificate in the Chromium Certificate Viewer hierarchy. I initially thought this was due to I didn't supply the root certificate in the certificate chain, so I modified nginx server config and added the root certificate in the certificate chain and the root certificate still didn't appear in the Certificate Viewer hierarchy.
If this is the reason, why Chromium Certificate Viewer shows the intermediate certificate? Both intermediate certificate and root certificate shouldn't appear in the Certificate Viewer hierarchy as the chain already broke at leaf - intermediate.
from oqs-demos.
If this is the reason, why Chromium Certificate Viewer shows the intermediate certificate?
I don't know this -- probably one would need to go through the cert verification logic of Chromium (nss) to really understand what's going on. Personally I didn't get around to looking into libnss
to be able to give a good answer.
from oqs-demos.
Good suggestion.
from oqs-demos.
As it seems this issue indeed is caused by libnss
not being QSC-enabled we'll close this issue referring to #92 for further discussions/activity. Please feel free to re-open this with further feedback if you don't think likewise, @Raytonne. Thanks again for your test & report!
from oqs-demos.
Related Issues (20)
- unable to pull the chrome file from server HOT 1
- Cannot switch off OQS_HAVE_GETENTROPY, OQS_HAVE_EXPLICIT_BZERO HOT 3
- Fix integrations to specific commits?
- OQS Chromium(117.0.5863.0) : ERR_SSL_VERSION_OR_CIPHER_MISMATCH HOT 15
- curl --write-out time_appconnect for SSL/TLS Handshake variable is faulty HOT 4
- Failed to build oqs-nginx on Mac M1
- Failed to build httpd on Mac M1 HOT 1
- ee key too small has occured in nginx with debian:bookworm-slim HOT 5
- https://test.openquantumsafe.org:6000 does not accept `x25519_kyber768`
- Wireshark Docker Build Fails with WolfSSL Due to Undeclared 'QSC_SIG_CPS' Variable HOT 1
- Update test server with liboqs 0.9.2 release HOT 3
- Introduce CI mechanism to use specific liboqs/oqs-provider versions
- Add QUIC support HOT 3
- !DOCTYPE ERROR HOT 1
- Not able to get OQS-Chromium browser working - https://openquantumsafe.org/applications/tls.html#chromium HOT 19
- oqs-epiphany not working HOT 11
- qteslapi is not supported by oqs openssl HOT 1
- Dont get Server Temp Key in openssl s_client when testing HOT 1
- Update test server with liboqs 0.10.0 release HOT 8
- HAProxy HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from oqs-demos.