[gentoo-user-de] Cacert.org verification

[Jan Kohnert]

Hi,

ich habe gerade ein kleines Verständnisproblem. Cacert.org ist in den 
Zertifikaten von ca-certificates enthalten. Leider erhalte ich im Brwoser eine 
Warnung, das Cacert.org kein vertrauenwüdriges Zertifikat hätte. Kurzer Test 
fördert folgendes zu Tage:

kohni /etc/ssl # openssl s_client -crlf -connect www.cacert.org:443
CONNECTED(00000003)
depth=0 /C=AU/ST=NSW/L=Sydney/O=CAcert 
Inc./CN=www.cacert.org/emailAddress=support@××××××.org
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 /C=AU/ST=NSW/L=Sydney/O=CAcert 
Inc./CN=www.cacert.org/emailAddress=support@××××××.org
verify error:num=27:certificate not trusted
verify return:1
depth=0 /C=AU/ST=NSW/L=Sydney/O=CAcert 
Inc./CN=www.cacert.org/emailAddress=support@××××××.org
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 0 s:/C=AU/ST=NSW/L=Sydney/O=CAcert 
Inc./CN=www.cacert.org/emailAddress=support@××××××.org
   i:/O=Root CA/OU=http://www.cacert.org/CN=CA Cert Signing 
Authority/emailAddress=support@××××××.org
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFVzCCAz+gAwIBAgIDCKU1MA0GCSqGSIb3DQEBBQUAMHkxEDAOBgNVBAoTB1Jv
b3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEiMCAGA1UEAxMZ
Q0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJARYSc3VwcG9y
dEBjYWNlcnQub3JnMB4XDTEwMDUxNDE0NTk0OFoXDTEyMDUxMzE0NTk0OFowfjEL
MAkGA1UEBhMCQVUxDDAKBgNVBAgTA05TVzEPMA0GA1UEBxMGU3lkbmV5MRQwEgYD
VQQKEwtDQWNlcnQgSW5jLjEXMBUGA1UEAxMOd3d3LmNhY2VydC5vcmcxITAfBgkq
hkiG9w0BCQEWEnN1cHBvcnRAY2FjZXJ0Lm9yZzCCASIwDQYJKoZIhvcNAQEBBQAD
ggEPADCCAQoCggEBAM3iqo3YIRO2BaAEEoZ/Ui8efBtl44PlQO71ubOvhc7lMU/W
SC/Vuw36z6O8WwvX2Lgx2gwYwJ94JvyHCAmNNQc0ohHHk7jNOeOieJKBX3kwCPnQ
SPQJpIZwR6gcpDsblEHADjq0Qugjdn5RTAg1v65xd8Y4yoalkETgtrncTZ1fkhpg
AVEYcx38JeLL3IHoDgTQH+M29XyIN2NJEnClkdoGftZlPCKEvd36T/kl6vrEm0Vy
ZV9orUAKG116J+Iwn+qFSgiz40gtDrpz9raEyixM72DqfY/4Gmgs1LrN19LEPu7u
IGvs/V8FqZ5twpfdctZq0iaq9fIGvWa1q9quvC0CAwEAAaOB4jCB3zAMBgNVHRMB
Af8EAjAAMDQGA1UdJQQtMCsGCCsGAQUFBwMCBggrBgEFBQcDAQYJYIZIAYb4QgQB
BgorBgEEAYI3CgMDMAsGA1UdDwQEAwIFoDAzBggrBgEFBQcBAQQnMCUwIwYIKwYB
BQUHMAGGF2h0dHA6Ly9vY3NwLmNhY2VydC5vcmcvMFcGA1UdEQRQME6CDCouY2Fj
ZXJ0Lm9yZ4IKY2FjZXJ0Lm9yZ4IMKi5jYWNlcnQubmV0ggpjYWNlcnQubmV0ggwq
LmNhY2VydC5jb22CCmNhY2VydC5jb20wDQYJKoZIhvcNAQEFBQADggIBAErVgsd2
7hZsBSMG+BbCHN9PUbJYAg7JMNYiIaPIsZGFUbuYGyqlLye5muLtMxTHzBfXM25+
ECwYy9jLpkzW7qz1dC2Glx4h6Gh6+//Klwa7rJ7M9EFuhMogY23YbCJMC2m1gGtW
Wer3kgQBbRI3LxiIf7HYbIdWGEJ2d1R0QjKPgQLn3gh3b9A35nptBQu/Zk3M/JzO
WV4WWG8TomBfLvYuG+tntZCrRCvnFZqN/+68qK74VVFR/wpbdnu+AEX7j44xhnGl
Wvye0S3zKQHnf0L01nMA4HXj1Z8+TyMMUNENF3/Of4SdDUnyFYjmUQAhZ49PHw1A
prPKZ7fijE+twQlHTPniDndgtWRU/m4IQadost2tgpZPZHiwNWiSeEgMMwwthIpa
WvLJFmUipxyxkqVKmb6r8geqAiN9ScvPkKX4x157FgxFd5nQ4ZnTjZ8Zg0vQDHaF
rNpELfvyLHppUiwOGt5NJmoSKyeII5k+80eAL/2Tngi1vM2rCznebGYa3LC7UoIT
zjX4N3bAcuq3l9UaGeFSp5D8oGv29DNC7sMNRJXtlGcLtjXJgJzaBSb0bsh468ri
nU4UDmnslHE2LEOkaswkGpq+eaxH/Cp5eE/rh7m+vLxm1jcuUnqNiJ+MmLJXMbFr
G6GvDP69u3UJgK5X/P6+WgXFSGEDJWb8gxUO
-----END CERTIFICATE-----
subject=/C=AU/ST=NSW/L=Sydney/O=CAcert 
Inc./CN=www.cacert.org/emailAddress=support@××××××.org
issuer=/O=Root CA/OU=http://www.cacert.org/CN=CA Cert Signing 
Authority/emailAddress=support@××××××.org
---
No client certificate CA names sent
---
SSL handshake has read 2031 bytes and written 343 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
98AD9021BD3BA8AA6053BC6E7CCC88048E819F926285CF8396A40330D6EAA0A94024CC6DB8A255A9535B3AB6B8CFDB3C
    Key-Arg   : None
    Start Time: 1279762275
    Timeout   : 300 (sec)
    Verify return code: 21 (unable to verify the first certificate)
---
^C
kohni /etc/ssl #
kohni /etc/ssl # openssl s_client -crlf -CApath /etc/ssl/certs/ -connect 
www.cacert.org:443CONNECTED(00000003)
depth=1 /O=Root CA/OU=http://www.cacert.org/CN=CA Cert Signing 
Authority/emailAddress=support@××××××.org
verify return:1
depth=0 /C=AU/ST=NSW/L=Sydney/O=CAcert 
Inc./CN=www.cacert.org/emailAddress=support@××××××.org
verify return:1
---
Certificate chain
 0 s:/C=AU/ST=NSW/L=Sydney/O=CAcert 
Inc./CN=www.cacert.org/emailAddress=support@××××××.org
   i:/O=Root CA/OU=http://www.cacert.org/CN=CA Cert Signing 
Authority/emailAddress=support@××××××.org
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFVzCCAz+gAwIBAgIDCKU1MA0GCSqGSIb3DQEBBQUAMHkxEDAOBgNVBAoTB1Jv
b3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEiMCAGA1UEAxMZ
Q0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJARYSc3VwcG9y
dEBjYWNlcnQub3JnMB4XDTEwMDUxNDE0NTk0OFoXDTEyMDUxMzE0NTk0OFowfjEL
MAkGA1UEBhMCQVUxDDAKBgNVBAgTA05TVzEPMA0GA1UEBxMGU3lkbmV5MRQwEgYD
VQQKEwtDQWNlcnQgSW5jLjEXMBUGA1UEAxMOd3d3LmNhY2VydC5vcmcxITAfBgkq
hkiG9w0BCQEWEnN1cHBvcnRAY2FjZXJ0Lm9yZzCCASIwDQYJKoZIhvcNAQEBBQAD
ggEPADCCAQoCggEBAM3iqo3YIRO2BaAEEoZ/Ui8efBtl44PlQO71ubOvhc7lMU/W
SC/Vuw36z6O8WwvX2Lgx2gwYwJ94JvyHCAmNNQc0ohHHk7jNOeOieJKBX3kwCPnQ
SPQJpIZwR6gcpDsblEHADjq0Qugjdn5RTAg1v65xd8Y4yoalkETgtrncTZ1fkhpg
AVEYcx38JeLL3IHoDgTQH+M29XyIN2NJEnClkdoGftZlPCKEvd36T/kl6vrEm0Vy
ZV9orUAKG116J+Iwn+qFSgiz40gtDrpz9raEyixM72DqfY/4Gmgs1LrN19LEPu7u
IGvs/V8FqZ5twpfdctZq0iaq9fIGvWa1q9quvC0CAwEAAaOB4jCB3zAMBgNVHRMB
Af8EAjAAMDQGA1UdJQQtMCsGCCsGAQUFBwMCBggrBgEFBQcDAQYJYIZIAYb4QgQB
BgorBgEEAYI3CgMDMAsGA1UdDwQEAwIFoDAzBggrBgEFBQcBAQQnMCUwIwYIKwYB
BQUHMAGGF2h0dHA6Ly9vY3NwLmNhY2VydC5vcmcvMFcGA1UdEQRQME6CDCouY2Fj
ZXJ0Lm9yZ4IKY2FjZXJ0Lm9yZ4IMKi5jYWNlcnQubmV0ggpjYWNlcnQubmV0ggwq
LmNhY2VydC5jb22CCmNhY2VydC5jb20wDQYJKoZIhvcNAQEFBQADggIBAErVgsd2
7hZsBSMG+BbCHN9PUbJYAg7JMNYiIaPIsZGFUbuYGyqlLye5muLtMxTHzBfXM25+
ECwYy9jLpkzW7qz1dC2Glx4h6Gh6+//Klwa7rJ7M9EFuhMogY23YbCJMC2m1gGtW
Wer3kgQBbRI3LxiIf7HYbIdWGEJ2d1R0QjKPgQLn3gh3b9A35nptBQu/Zk3M/JzO
WV4WWG8TomBfLvYuG+tntZCrRCvnFZqN/+68qK74VVFR/wpbdnu+AEX7j44xhnGl
Wvye0S3zKQHnf0L01nMA4HXj1Z8+TyMMUNENF3/Of4SdDUnyFYjmUQAhZ49PHw1A
prPKZ7fijE+twQlHTPniDndgtWRU/m4IQadost2tgpZPZHiwNWiSeEgMMwwthIpa
WvLJFmUipxyxkqVKmb6r8geqAiN9ScvPkKX4x157FgxFd5nQ4ZnTjZ8Zg0vQDHaF
rNpELfvyLHppUiwOGt5NJmoSKyeII5k+80eAL/2Tngi1vM2rCznebGYa3LC7UoIT
zjX4N3bAcuq3l9UaGeFSp5D8oGv29DNC7sMNRJXtlGcLtjXJgJzaBSb0bsh468ri
nU4UDmnslHE2LEOkaswkGpq+eaxH/Cp5eE/rh7m+vLxm1jcuUnqNiJ+MmLJXMbFr
G6GvDP69u3UJgK5X/P6+WgXFSGEDJWb8gxUO
-----END CERTIFICATE-----
subject=/C=AU/ST=NSW/L=Sydney/O=CAcert 
Inc./CN=www.cacert.org/emailAddress=support@××××××.org
issuer=/O=Root CA/OU=http://www.cacert.org/CN=CA Cert Signing 
Authority/emailAddress=support@××××××.org
---
No client certificate CA names sent
---
SSL handshake has read 2031 bytes and written 343 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
AE3DBB6551AC437D845CE291F22DD1E10F7357256F9DA197749A0215F350D9E65065451D63CDC41AAE7615752A885E44
    Key-Arg   : None
    Start Time: 1279762313
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---
^C
kohni /etc/ssl #
kohni /etc/ssl # eix ^openssl$
[I] dev-libs/openssl
     Available versions:  
        (0)     0.9.8o ~1.0.0a
        (0.9.8) ~0.9.8o-r1
        {bindist gmp kerberos rfc3779 sse2 test zlib}
     Installed versions:  0.9.8o(03:01:54 04.06.2010)(gmp sse2 zlib -bindist -
kerberos -test)
     Homepage:            http://www.openssl.org/
     Description:         Toolkit for SSL v2/v3 and TLS v1

kohni /etc/ssl # 

Prinzipiell geht es also, sofern openssl weiß, wo es die CA Zertifikate 
findet. Nur, wie sage ich ihm das automagisch? /etc/ssl/openssl.cnf ist nicht 
sehr hilfreich...

Welche Doku/Einstallung habe ich gerade übersehen?

-- 
MfG Jan