[SOLVED] pinning-test.badssl.com not triggering cert error

[ndesktop]

I'm debugging CEF for the URL https://pinning-test.badssl.com/ and no error is triggered.
For some reason CERT_STATUS_PINNED_KEY_MISSING is not fired.

"Show SSL Information" from the contextual menu also does not show Status error (in fact, it does not show any status).

Chrome blocks the page and displays

Code: Select all

Your connection is not private
Attackers might be trying to steal your information from pinning-test.badssl.com (for example, passwords, messages, or credit cards). Learn more
NET::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN
 

Is there any option/custom modification in CEF/Chromium source code that might help to catch this?
I've placed breakpoints in all ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN places I could find in CEF 3282 (I know, deprecated) but no stop.

The page displays in cefclient
"This site is preloaded with a bad HPKP pin starting in Chrome 48."
so I don't think is 3282 related.

[Czarek]

Not sure if related, but It seems CEF is missing these cert flags that are defined in upstream:

Code: Select all

// Bits 24 - 31 are for errors.
CERT_STATUS_FLAG(CERTIFICATE_TRANSPARENCY_REQUIRED, 1 << 24)
CERT_STATUS_FLAG(SYMANTEC_LEGACY, 1 << 25)


There is this comment in CEF header file cef_types.h:

Code: Select all

// Bits 16 to 31 are for non-error statuses.


Which seems wrong.

[ndesktop]

Might be right.

In Chromium source code search for ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN I see this is handled explicitely:

Code: Select all

bool IsCertificateError(int error) {
  // Certificate errors are negative integers from net::ERR_CERT_BEGIN
  // (inclusive) to net::ERR_CERT_END (exclusive) in *decreasing* order.
  // ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN is currently an exception to this
  // rule.
  return (error <= ERR_CERT_BEGIN && error > ERR_CERT_END) ||
         (error == ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN);
}

[ndesktop]

Filed issue 2467.
I'm planning a patch in the next days, but if is something simple and someone else is quicker, by all means PR this one.

[ndesktop]

HPKP is not enabled for developer builds. Closing issue as invalid, since CEF for sure won't maintain official pins.