SSL fails with all hosts. (SSL certificate problem: self signed certificate in certificate chain)

user_8217982 0
Viewed 10355

I'm using the Linux subsystem for Windows with Ubuntu 16.04. Haven't had any problems such as this before.

Currently any attempt to use SSL from Ubuntu (curl, python, anything etc.) returns an error along the lines of "self signed certificate in certificate chain".

Running:

curl -v https://accounts.google.com

returns: 

*   Trying 172.217.12.77...
* TCP_NODELAY set
* Expire in 149889 ms for 3 (transfer 0x7fffe443e570)
* Expire in 200 ms for 4 (transfer 0x7fffe443e570)
* Connected to accounts.google.com (172.217.12.77) port 443 (#0)
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /home/<username>/anaconda3/ssl/cacert.pem
  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: self signed certificate in certificate chain
* Closing connection 0
curl: (60) SSL certificate problem: self signed certificate in certificate chain
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

I have no idea what is causing the error. In Windows everything works fine. I removed and reinstalled openssl and ca-certificates with apt-get but that didn't help. I tried completely disabling the Windows Firewall but that didn't help either. Currently my workaround is to disable verification of certificates but that obviously isn't a long-term solution.

Edit: Using "openssl s_client -connect accounts.google.com:443" returns:

CONNECTED(00000004)
depth=2 C = DE, ST = Frankfurt, L = Frankfurt, O = netSkope Inc, OU = Cert Management, CN = caadmin.netskope.com, emailAddress = certadmin@netskope.com
verify error:num=19:self signed certificate in certificate chain
verify return:1
depth=2 C = DE, ST = Frankfurt, L = Frankfurt, O = netSkope Inc, OU = Cert Management, CN = caadmin.netskope.com, emailAddress = certadmin@netskope.com
verify return:1
depth=1 C = GB, ST = GB, L = London, O = TBWA UK LTD, OU = 47fdec0de5a28c3f38b67c1767c1977e, CN = ca.oss.de.goskope.com, emailAddress = certadmin@netskope.com
verify return:1
depth=0 CN = *.accounts.google.com
verify return:1
---
Certificate chain
 0 s:CN = *.accounts.google.com
   i:C = GB, ST = GB, L = London, O = TBWA UK LTD, OU = 47fdec0de5a28c3f38b67c1767c1977e, CN = ca.oss.de.goskope.com, emailAddress = certadmin@netskope.com
 1 s:C = GB, ST = GB, L = London, O = TBWA UK LTD, OU = 47fdec0de5a28c3f38b67c1767c1977e, CN = ca.oss.de.goskope.com, emailAddress = certadmin@netskope.com
   i:C = DE, ST = Frankfurt, L = Frankfurt, O = netSkope Inc, OU = Cert Management, CN = caadmin.netskope.com, emailAddress = certadmin@netskope.com
 2 s:C = DE, ST = Frankfurt, L = Frankfurt, O = netSkope Inc, OU = Cert Management, CN = caadmin.netskope.com, emailAddress = certadmin@netskope.com
   i:C = DE, ST = Frankfurt, L = Frankfurt, O = netSkope Inc, OU = Cert Management, CN = caadmin.netskope.com, emailAddress = certadmin@netskope.com
---
Server certificate
-----BEGIN CERTIFICATE-----
MIID8jCCAtqgAwIBAgIQGCu6BLIHRaW5ajAUR6l3nDANBgkqhkiG9w0BAQsFADCB
...
IuyKTaSo
-----END CERTIFICATE-----
subject=CN = *.accounts.google.com

issuer=C = GB, ST = GB, L = London, O = TBWA UK LTD, OU = 47fdec0de5a28c3f38b67c1767c1977e, CN = ca.oss.de.goskope.com, emailAddress = certadmin@netskope.com

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 3910 bytes and written 401 bytes
Verification error: self signed certificate in certificate chain
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 19 (self signed certificate in certificate chain)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: DC5244B88B2BD84F10696D872393D7F526B3FA174278F1B6B2F26AE57C7FE8B5
    Session-ID-ctx:
    Resumption PSK: F0A7FB5E51C7296C40FF669B5A7E6B47DD1F4B1CD6E3FEBF7F6B5D3BAF70A57FFE74F536298EB57CF2C8803FED10BECE
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 90 e0 87 ea 85 33 01 dc-7d 2a 3d 33 e2 47 34 45   .....3..}*=3.G4E
    ...
    00c0 - 43 e8 a3 e3 79 b1 c5 86-5c 4b ee c0 d6 5c 74 84   C...y...\K...\t.

    Start Time: 1571235994
    Timeout   : 7200 (sec)
    Verify return code: 19 (self signed certificate in certificate chain)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: 2DFF6D4B774F97F3E6EE7710B1159D8C3357970111CBCCBB1A56CFB7B2490C4F
    Session-ID-ctx:
    Resumption PSK: 3910D4FF6C327569EEF7A4C4B346E21CCEBE4BB4789E3CF065967601D0580638D124AA96B282B3AF908D4F8D59D4950A
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 90 e0 87 ea 85 33 01 dc-7d 2a 3d 33 e2 47 34 45   .....3..}*=3.G4E
    ...
    00c0 - e6 c1 09 c9 3d 40 c6 3e-ca ee 00 cd fe 35 51 c9   ....=@.>.....5Q.

    Start Time: 1571235995
    Timeout   : 7200 (sec)
    Verify return code: 19 (self signed certificate in certificate chain)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
openssl curl ssl-certificate ssl
2 Answers

It seems like you have Netskope client installed in Windows machine, Netskope client doesn't itself inspect ssl traffic but it breaks the SSL traffic going directly to Destination by acting as a proxy and present its own certificate and sends traffic to Netskope proxy for ssl inspection.

Generally, when you install Netskope client, it installs it's CA cert in System cert store also in Mozilla cert store but if you're running Linux machine inside a VM, you'll get the cert error because the CA certs are added to Windows cert store , not in Linux.

To solve this:

  1. You can get Netskope CA cert from windows machine from the path:

C:\ProgramData\netskope\stagent\data

Files: nscacert.pem and nstenantcert.pem

use these PAM files and add it to Linux Ca-certificates lists. Probably at /usr/local/share/ca-certificates/ and run update-ca-certificates

https://superuser.com/questions/437330/how-do-you-add-a-certificate-authority-ca-to-ubuntu

user_110973680

My guess is that there is an SSL intercepting antivirus product installed in Windows (Avira, Kaspersky, ESET, ... all have such capabilities and often do it by default).

This is not a problem for browsers in Windows since these AV also install their root CA into the trust stores of the system and of the browsers and thus work transparently for applications on Windows. The OS trust store from Windows has no effect on the trust store(s) in the Linux subsystem though which therefore still gets its SSL connections intercepted but does not trust the certificate issued by the AV since it has no trust in the CA used by the AV.

If you disable the AV or the SSL interception done in the AV the problem will likely vanish.

user_30810180
Related