I'm encountering a problem of which I don't know how to fix.
I'm trying to setup an HTTPS server running locally on a Windows host A and have a DNS server running on host B. The DNS server always returns 127.0.0.1, resulting in the URL https://www.somedomain.com referring to the local HTTPS server. However, the problem occurs when trying to connect to the HTTPS server, see the title of this post.
I created a CA certificate:
openssl genrsa -des3 -out rootCA.key 2048
openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem
I imported it via mmc.exe as per: https://learn.microsoft.com/en-us/skype-sdk/sdn/articles/installing-the-trusted-root-certificate.
Then, I created a certificate for the domain "www.somedomain.com" (from https://www.freecodecamp.org/news/how-to-get-https-working-on-your-local-development-environment-in-5-minutes-7af615770eec):
openssl req -new -sha256 -nodes -out server.csr -newkey rsa:2048 -keyout server.key
openssl x509 -req -in server.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out server.crt -days 500 -sha256 -extfile v3.ext
I then run the HTTPS server via Python and check whether it is running with the following command:
"C:\Program Files\OpenSSL-Win64\bin\openssl.exe" s_client -showcerts -CAfile C:\Users\[USER]\Desktop\certs\rootCA.pem -servername www.somedomain.com -connect www.somedomain.com:443 | "C:\Program Files\OpenSSL-Win64\bin\openssl.exe" x509 -inform pem -noout -text
depth=1 C = IN, ST = Random, L = Random, O = Random, OU = Random, CN = Local Certificate, emailAddress = example@domain.com
verify return:1
depth=0 C = DE, ST = State, L = City, O = Organizational name, OU = OU, CN = www.somedomain.com, emailAddress = example@domain.com
verify return:1
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
3a:de:0f:e5:a7:1d:c2:05:26:dd:c6:89:79:6c:bd:79:c9:c8:7e:41
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = IN, ST = Random, L = Random, O = Random, OU = Random, CN = Local Certificate, emailAddress = example@domain.com
Validity
Not Before: Sep 20 22:24:07 2022 GMT
Not After : Feb 2 22:24:07 2024 GMT
Subject: C = DE, ST = State, L = City, O = Organizational name, OU = OU, CN = www.somedomain.com, emailAddress = example@domain.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:df:93:ce:2a:d5:78:4c:ce:08:18:31:ea:6b:1c:
78:d0:2d:25:f8:21:cf:ab:ab:97:dc:70:d1:a5:98:
8a:69:9e:f0:b2:45:a4:c8:b7:a5:a1:85:da:5e:cf:
19:25:99:87:40:02:d4:20:30:6b:50:2c:88:cd:6c:
46:5a:8f:0f:f7:54:69:9a:55:36:15:bc:df:e7:cc:
03:06:65:2e:67:f3:f4:69:72:ad:7d:4d:41:d3:40:
05:32:8e:54:4f:ff:7d:d5:67:14:eb:86:93:bb:39:
9f:e5:e1:2a:fd:e7:8c:3d:e1:ff:31:b8:c2:d7:82:
7f:3b:aa:a8:20:93:08:ca:02:6a:8e:0c:bc:c5:c7:
cb:88:68:43:78:13:15:bd:fd:57:ee:80:fe:a2:c2:
cf:fc:c9:9d:70:29:1b:c3:4c:44:70:f0:96:37:8b:
7b:26:fb:0b:a3:85:90:9e:8c:f5:d9:de:ec:17:a1:
34:42:ac:f8:a4:03:8a:9e:f9:f8:49:0b:2a:3a:b2:
4b:ff:b5:60:d5:08:bb:47:cb:37:2a:07:f9:4d:2b:
60:86:ed:48:15:33:70:d8:b3:d0:7c:52:7c:33:51:
80:fc:10:3b:11:a1:fd:c8:ff:7a:7c:07:7b:62:53:
31:a2:f0:ee:37:cc:9a:d7:3e:71:af:10:28:2e:7e:
96:95
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Authority Key Identifier:
15:2D:B8:EB:92:7D:AE:58:D7:04:D6:9B:A3:7F:DA:B2:B0:91:13:33
X509v3 Basic Constraints:
CA:FALSE
X509v3 Key Usage:
Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment
X509v3 Subject Alternative Name:
DNS:www.somedomain.com
X509v3 Subject Key Identifier:
93:85:39:18:7B:A2:57:2A:1C:B7:3C:E8:B4:56:B3:0F:AE:4A:38:66
Signature Algorithm: sha256WithRSAEncryption
Signature Value:
5c:4b:90:61:e7:47:62:25:40:4d:95:ec:ac:53:aa:58:dc:1c:
b0:b6:25:d1:71:f0:67:36:ca:2c:f6:a1:53:54:23:94:63:29:
9e:18:f7:3c:25:5e:cb:d3:36:f1:47:4f:7b:f4:cd:28:cd:16:
6f:dd:c4:3f:7d:c2:29:a4:c8:3e:9e:a3:1d:8f:f4:7a:52:67:
89:38:fa:46:4b:9b:f6:59:17:ba:68:b7:50:4a:92:f1:6d:b0:
aa:f2:a1:da:4b:df:b8:5d:2e:b5:a3:fc:22:2a:be:c3:39:bb:
9d:5f:61:c4:32:82:64:2f:8d:f0:e3:82:fa:8f:f5:10:ff:3b:
55:f7:7d:18:3f:21:9c:4c:09:e8:fa:aa:aa:4c:77:4d:88:92:
b2:f8:76:3a:04:3e:54:78:d9:0a:7a:4d:06:d7:ef:7f:f0:38:
45:36:47:4c:fb:73:cd:2c:ea:99:11:b6:5a:3c:4f:c1:5e:3d:
26:85:bf:4e:2d:9e:13:d0:04:19:77:2d:82:8d:43:9f:4b:58:
8f:74:d9:7b:52:e3:74:73:36:ec:72:75:3f:c3:ee:92:5b:78:
ed:55:47:b2:b7:4e:ff:8e:62:46:94:89:70:6b:77:a4:4e:ee:
cb:9c:df:6d:6f:f0:03:51:2e:e4:1f:54:44:a8:16:e3:0d:91:
58:a2:a1:8d
Unless I specify the CAfile parameter, the verification fails, which is also weird to me, since I would think that it should be able to find it in Windows' CA list.
So the Common Name shows the hostname should be "www.somedomain.com", yet when I try to connect to it, this happens:
curl -vv https://www.somdomain.com/
* Trying 127.0.0.1:443...
* Connected to www.somdomain.com (127.0.0.1) port 443 (#0)
* schannel: disabled automatic use of client certificate
* schannel: ALPN, offering http/1.1
* schannel: SNI or certificate check failed: SEC_E_WRONG_PRINCIPAL (0x80090322) - The target principal name is incorrect.
* Closing connection 0
curl: (60) schannel: SNI or certificate check failed: SEC_E_WRONG_PRINCIPAL (0x80090322) - The target principal name is incorrect.
More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
It seems that the CA is still not trusted, yet it is present when I use mmc.exe. Does someone have an idea where it goes wrong?
Source code of the HTTPS server:
import http.server, ssl
server_address = ('127.0.0.1', 443)
httpd = http.server.HTTPServer(server_address, http.server.SimpleHTTPRequestHandler)
httpd.socket = ssl.wrap_socket(httpd.socket,
server_side=True,
certfile='C:\\Users\\[USER]\\Desktop\\certs\\server.crt',
keyfile='C:\\Users\\[USER]\\Desktop\\certs\\server.key',
ssl_version=ssl.PROTOCOL_TLS)
print("Running the server...")
try:
httpd.serve_forever()
except KeyboardInterrupt:
pass
httpd.server_close()