Search code examples
ssldnsopensslssl-certificateshibboleth

build.shibboleth.net gives wrong certificate for some regions

One of our Jenkins builds is failing trying to connect to build.shibboleth.net. So I did some analysis.

Please look at these openssl results from 2 regions.

In South Asia region: It gives the cert of test.shibboleth.net, which is wrong.

$ openssl s_client -host build.shibboleth.net -port 443 -prexit -showcerts

CONNECTED(00000005)
depth=1 C = US, ST = Ohio, O = Shibboleth Consortium, CN = Shibboleth Project Intermediate CA
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/C=US/ST=Ohio/O=Shibboleth Consortium/CN=test.shibboleth.net
   i:/C=US/ST=Ohio/O=Shibboleth Consortium/CN=Shibboleth Project Intermediate CA
...
...

In USA region: It gives the cert of shibboleth.net, which is correct.

$ openssl s_client -host build.shibboleth.net -port 443 -prexit -showcerts

CONNECTED(00000005)
depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
verify return:1
depth=0 CN = shibboleth.net
verify return:1
---
Certificate chain
 0 s:CN = shibboleth.net
   i:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
...
...

And resolveip build.shibboleth.net gives 3.213.250.186 from both regions.

Why is it giving a wrong certificate for one region? I have no clue how to fix this. Any ideas?

Solution

  • I'd speculate that the results above aren't caused by region dependence but instead that you're using a different version of openssl on the two client machines.

    We used to run the different vhosts on different IP addresses. Now, one address is used for everything and we rely on SNI to distinguish requests so that the right certificate is returned.

    If the openssl client doesn't present the server name then you might get a default certificate instead of the one you expected. Whether openssl does that or not depends on the version of openssl in use (openssl version 1.1.1 does, earlier versions don't).

    You can try adding -servername build.shibboleth.net to your openssl command to see if that changes the behaviour.