BUG #14625: Error "sslv3 alert certificate expired" with valid certificate

From: pavel(dot)l(dot)kirichenko(at)gmail(dot)com
To: pgsql-bugs(at)postgresql(dot)org
Subject: BUG #14625: Error "sslv3 alert certificate expired" with valid certificate
Date: 2017-04-18 14:29:19
Message-ID: 20170418142919.24369.5931@wrigleys.postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

The following bug has been logged on the website:

Bug reference: 14625
Logged by: Pavel Kirichenko
Email address: pavel(dot)l(dot)kirichenko(at)gmail(dot)com
PostgreSQL version: 9.6.2
Operating system: FreeBSD 11.0-RELEASE-p9 amd64
Description:

Version OpenSSL 1.0.2k_1,1

postgresql.conf
ssl = true
ssl_ciphers =
'kEECDH+AES128:kEECDH:kEDH:-3DES:kRSA+AES128:kEDH+3DES:DES-CBC3-SHA:!RC4:!aNULL:!eNULL:!MD5:!EXPORT:!LOW:!SEED:!CAMELLIA:!IDEA:!PSK:!SRP:!SSLv2'
ssl_prefer_server_ciphers = on
ssl_ecdh_curve = 'prime256v1'
ssl_cert_file = './ssl/server.crt'
ssl_key_file = './ssl/server.key'
ssl_ca_file = './ssl/root.crt'
ssl_crl_file = './ssl/root.crl'

pg_hba.conf
# TYPE DATABASE USER ADDRESS
METHOD

# "local" is for Unix domain socket connections only
local all postgres
md5
# IPv4 local connections:
host all all 127.0.0.1/32 md5
hostssl all all 0.0.0.0/0 md5
clientcert=1
# IPv6 local connections:
host all all ::1/128 md5
hostssl all all ::/0 md5
clientcert=1

I tryed to connect from the command line interface:
$ psql --host=192.168.1.3 --port=6543 --username=postgres
--dbname=template1
psql: SSL error: certificate verify failed

So I had such log message.
LOG: could not accept SSL connection: sslv3 alert certificate expired

Then I checked the certificates.

[pavel(dot)l(dot)kirichenko(at)rat-3o3r3d3 /usr/home/pavel.l.kirichenko/.postgresql]$
openssl x509 -in ./postgresql.crt -text -noout
Certificate:
Data:
Version: 1 (0x0)
Serial Number: 2 (0x2)
Signature Algorithm: sha256WithRSAEncryption

Validity
Not Before: Mar 20 13:05:04 2017 GMT
Not After : Mar 18 13:05:04 2027 GMT

Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (4096 bit)

Time on the server is:
$ date
monday, 17 april 2017 г. 17:45:37 (+04)

Apparently, the certificate has not expired.

You can say that the problem is in OpenSSL. I checked it. With this
certificates I configured the test nginx site on the same server — it works
properly.

The same error is repeated everywhere: psql, pgAdmin, connection via
dotConnect driver.
Also I tested PostgreSQL version 9.4.11, I tryed to reduce key length to 512
bit and even psql on Ubuntu 14.04.1 with no success.

Certificates:
server https://mega.nz/#!j9NTlCgD!6Rps9gF5s9b4qSkcliMQzKowWBDEMT5q28WqnVsJpAo
client https://mega.nz/#!DltUWYia!lvR5BfKlxTS0TK0gYNHTsZrhjUngTTRQRkTwWsf5V6c

Browse pgsql-bugs by date

  From Date Subject
Next Message Nico Williams 2017-04-19 19:32:13 pg_dump(1) failures when concurrently refreshing mat views
Previous Message Tomasz Szypowski 2017-04-18 13:57:15 Re: could not fork autovacuum worker process: No error