CODEWITHSUNDEEP
linuxopenssl
Adam C.
Adam C.

Reputation: 23

Statically linked openssl, where are the CA certificate loaded from?

I'm trying to fix an old binary (sources unavailable of course...) that fails to connect now, probably because it's using outdated list of CAs.

However, when running through strace I don't see the binary attempting to read my CAs from /etc/ssl/certs.

Is it possible the list of CAs has been bundled into the binary itself ?

Thanks a lot,

Adam

Upvotes: 0

Views: 361

Answers (1)

dave_thompson_085
dave_thompson_085

Reputation: 39010

To be clear, since you say source unavailable I assume you mean a custom program that uses OpenSSL library, since the source for the utility commandline-interface progam named openssl is still available for versions dating back to last century (and until 1.1.0 didn't change much, even when it probably should have).

Yes, definitely. A program using libssl (and libcrypto) can choose whether to use the standard file(s) for its truststore, or some other (custom) file(s) it specifies (often from configuration), or hardcoded data as you ask or data from some other source like a (secure, we hope!) database, or even no truststore at all if it uses ciphersuites that don't use certificate authentication -- anonymous, PSK or SRP -- which is rarely used but is supported by OpenSSL.

You might try strings on the program to see if they were basic enough to embed certs (and maybe other things) in PEM -- IINM that's how Lenovo Superfish was found. If they embedded binary 'DER', that still has enough redundancy you could find it, but not so easily.

Look at the network traffic with Wireshark or similar, or if you have access to the server check its logs, to see if the program is sending an alert in the range 41 to 49 in response to the server's first flight i.e. just after ServerHelloDone. That would definitively indicate a certificate problem.

Upvotes: 1

Related Questions