Repository navigation
X509VerificationFlags.IgnoreNotTimeValid no effect on macOS #38005
Description
On macOS 10.15.5, setting...
chain.ChainPolicy.VerificationFlags = X509VerificationFlags.IgnoreNotTimeValid;..does not appear to have the expected result. Consider this self-contained example (apologies for giant byte blob)
using System;
using System.Security.Cryptography.X509Certificates;
static class Scratch {
public static void Main() {
byte[] der = new byte[] {
0x30, 0x82, 0x04, 0x98, 0x30, 0x82, 0x03, 0x80, 0xa0, 0x03, 0x02, 0x01,
0x02, 0x02, 0x12, 0x03, 0x61, 0x46, 0x02, 0x9c, 0x7b, 0xdc, 0xdd, 0xe5,
0x33, 0x46, 0xa1, 0x64, 0x27, 0xe3, 0x39, 0x00, 0x7c, 0x30, 0x0d, 0x06,
0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00,
0x30, 0x4a, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13,
0x02, 0x55, 0x53, 0x31, 0x16, 0x30, 0x14, 0x06, 0x03, 0x55, 0x04, 0x0a,
0x13, 0x0d, 0x4c, 0x65, 0x74, 0x27, 0x73, 0x20, 0x45, 0x6e, 0x63, 0x72,
0x79, 0x70, 0x74, 0x31, 0x23, 0x30, 0x21, 0x06, 0x03, 0x55, 0x04, 0x03,
0x13, 0x1a, 0x4c, 0x65, 0x74, 0x27, 0x73, 0x20, 0x45, 0x6e, 0x63, 0x72,
0x79, 0x70, 0x74, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74,
0x79, 0x20, 0x58, 0x33, 0x30, 0x1e, 0x17, 0x0d, 0x32, 0x30, 0x30, 0x33,
0x30, 0x38, 0x30, 0x31, 0x33, 0x39, 0x31, 0x31, 0x5a, 0x17, 0x0d, 0x32,
0x30, 0x30, 0x36, 0x30, 0x36, 0x30, 0x31, 0x33, 0x39, 0x31, 0x31, 0x5a,
0x30, 0x17, 0x31, 0x15, 0x30, 0x13, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13,
0x0c, 0x76, 0x63, 0x73, 0x6a, 0x6f, 0x6e, 0x65, 0x73, 0x2e, 0x64, 0x65,
0x76, 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d,
0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07,
0x03, 0x42, 0x00, 0x04, 0x05, 0xd6, 0xcf, 0xa2, 0xff, 0x5e, 0xbb, 0x45,
0x60, 0xa2, 0x98, 0x26, 0x50, 0x08, 0xde, 0xcc, 0x10, 0x90, 0xaf, 0x85,
0xeb, 0x4d, 0x20, 0x17, 0x7c, 0x0b, 0x8e, 0x4d, 0x6c, 0xaa, 0x8d, 0x9a,
0xaa, 0x28, 0xe9, 0x55, 0x4f, 0xd1, 0x00, 0x03, 0x6a, 0x7c, 0x6e, 0xd9,
0xf5, 0xac, 0xd9, 0xfd, 0x31, 0xa4, 0xe8, 0x3e, 0xc3, 0x5a, 0x2b, 0x39,
0xbf, 0x1d, 0x62, 0x6d, 0x4b, 0x72, 0x1f, 0xa5, 0xa3, 0x82, 0x02, 0x74,
0x30, 0x82, 0x02, 0x70, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d, 0x0f, 0x01,
0x01, 0xff, 0x04, 0x04, 0x03, 0x02, 0x07, 0x80, 0x30, 0x1d, 0x06, 0x03,
0x55, 0x1d, 0x25, 0x04, 0x16, 0x30, 0x14, 0x06, 0x08, 0x2b, 0x06, 0x01,
0x05, 0x05, 0x07, 0x03, 0x01, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05,
0x07, 0x03, 0x02, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01,
0xff, 0x04, 0x02, 0x30, 0x00, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e,
0x04, 0x16, 0x04, 0x14, 0xc7, 0xac, 0x28, 0xef, 0xb3, 0x00, 0xf4, 0x6f,
0x94, 0x06, 0xed, 0x15, 0x56, 0x28, 0xa1, 0x23, 0x63, 0x3e, 0x55, 0x6f,
0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80,
0x14, 0xa8, 0x4a, 0x6a, 0x63, 0x04, 0x7d, 0xdd, 0xba, 0xe6, 0xd1, 0x39,
0xb7, 0xa6, 0x45, 0x65, 0xef, 0xf3, 0xa8, 0xec, 0xa1, 0x30, 0x6f, 0x06,
0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x01, 0x01, 0x04, 0x63, 0x30,
0x61, 0x30, 0x2e, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30,
0x01, 0x86, 0x22, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x6f, 0x63,
0x73, 0x70, 0x2e, 0x69, 0x6e, 0x74, 0x2d, 0x78, 0x33, 0x2e, 0x6c, 0x65,
0x74, 0x73, 0x65, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x2e, 0x6f, 0x72,
0x67, 0x30, 0x2f, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30,
0x02, 0x86, 0x23, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x63, 0x65,
0x72, 0x74, 0x2e, 0x69, 0x6e, 0x74, 0x2d, 0x78, 0x33, 0x2e, 0x6c, 0x65,
0x74, 0x73, 0x65, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x2e, 0x6f, 0x72,
0x67, 0x2f, 0x30, 0x17, 0x06, 0x03, 0x55, 0x1d, 0x11, 0x04, 0x10, 0x30,
0x0e, 0x82, 0x0c, 0x76, 0x63, 0x73, 0x6a, 0x6f, 0x6e, 0x65, 0x73, 0x2e,
0x64, 0x65, 0x76, 0x30, 0x11, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05,
0x07, 0x01, 0x18, 0x04, 0x05, 0x30, 0x03, 0x02, 0x01, 0x05, 0x30, 0x4c,
0x06, 0x03, 0x55, 0x1d, 0x20, 0x04, 0x45, 0x30, 0x43, 0x30, 0x08, 0x06,
0x06, 0x67, 0x81, 0x0c, 0x01, 0x02, 0x01, 0x30, 0x37, 0x06, 0x0b, 0x2b,
0x06, 0x01, 0x04, 0x01, 0x82, 0xdf, 0x13, 0x01, 0x01, 0x01, 0x30, 0x28,
0x30, 0x26, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x02, 0x01,
0x16, 0x1a, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x63, 0x70, 0x73,
0x2e, 0x6c, 0x65, 0x74, 0x73, 0x65, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74,
0x2e, 0x6f, 0x72, 0x67, 0x30, 0x82, 0x01, 0x04, 0x06, 0x0a, 0x2b, 0x06,
0x01, 0x04, 0x01, 0xd6, 0x79, 0x02, 0x04, 0x02, 0x04, 0x81, 0xf5, 0x04,
0x81, 0xf2, 0x00, 0xf0, 0x00, 0x76, 0x00, 0xf0, 0x95, 0xa4, 0x59, 0xf2,
0x00, 0xd1, 0x82, 0x40, 0x10, 0x2d, 0x2f, 0x93, 0x88, 0x8e, 0xad, 0x4b,
0xfe, 0x1d, 0x47, 0xe3, 0x99, 0xe1, 0xd0, 0x34, 0xa6, 0xb0, 0xa8, 0xaa,
0x8e, 0xb2, 0x73, 0x00, 0x00, 0x01, 0x70, 0xb8, 0x02, 0xba, 0xc9, 0x00,
0x00, 0x04, 0x03, 0x00, 0x47, 0x30, 0x45, 0x02, 0x21, 0x00, 0xd5, 0xe2,
0x75, 0x54, 0x1d, 0x94, 0x08, 0x39, 0xf2, 0xee, 0x76, 0x0f, 0xf1, 0xf9,
0xb7, 0xde, 0x18, 0x20, 0xce, 0x55, 0x24, 0xdb, 0xca, 0x15, 0x80, 0x57,
0xa1, 0xd5, 0x50, 0x39, 0x68, 0x6c, 0x02, 0x20, 0x0c, 0x6c, 0x3a, 0x31,
0x60, 0x4e, 0x4e, 0x2e, 0x41, 0x29, 0xbd, 0xf4, 0xb9, 0x0d, 0xa2, 0xf9,
0xea, 0xb3, 0xe7, 0x3b, 0xe1, 0x27, 0x03, 0x50, 0x84, 0x46, 0x96, 0x78,
0x3b, 0x6e, 0xe1, 0xf6, 0x00, 0x76, 0x00, 0x07, 0xb7, 0x5c, 0x1b, 0xe5,
0x7d, 0x68, 0xff, 0xf1, 0xb0, 0xc6, 0x1d, 0x23, 0x15, 0xc7, 0xba, 0xe6,
0x57, 0x7c, 0x57, 0x94, 0xb7, 0x6a, 0xee, 0xbc, 0x61, 0x3a, 0x1a, 0x69,
0xd3, 0xa2, 0x1c, 0x00, 0x00, 0x01, 0x70, 0xb8, 0x02, 0xbb, 0x14, 0x00,
0x00, 0x04, 0x03, 0x00, 0x47, 0x30, 0x45, 0x02, 0x20, 0x61, 0x60, 0xaa,
0xa9, 0x23, 0x07, 0xf2, 0xc6, 0x13, 0x5c, 0x08, 0xbf, 0xaa, 0x2b, 0xcc,
0x95, 0xf7, 0x4a, 0x7b, 0xa1, 0x82, 0x74, 0x91, 0x70, 0xcd, 0x85, 0xcf,
0x13, 0x86, 0x76, 0x3a, 0x98, 0x02, 0x21, 0x00, 0xe8, 0xfc, 0xfa, 0xdd,
0x47, 0xc3, 0x5c, 0x35, 0x37, 0xdb, 0x56, 0xbb, 0x69, 0xce, 0x4b, 0x33,
0x82, 0x5e, 0xb5, 0x58, 0xf2, 0x9b, 0x8f, 0x89, 0xa8, 0xd6, 0x56, 0x51,
0x44, 0xd7, 0xe9, 0x82, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00,
0x8b, 0xf1, 0x23, 0x01, 0x81, 0x45, 0x44, 0x7c, 0xd4, 0x93, 0x20, 0x35,
0xef, 0xeb, 0x0e, 0xdc, 0x0b, 0xe4, 0x85, 0x77, 0x74, 0x28, 0xd5, 0x20,
0xee, 0xc6, 0xce, 0x99, 0xf7, 0xaf, 0x08, 0x0a, 0x24, 0x0f, 0xbb, 0xf0,
0x58, 0xe0, 0x6a, 0x09, 0x6d, 0x1e, 0x56, 0xde, 0xf9, 0x4c, 0x3d, 0x4f,
0x5d, 0x4e, 0xaa, 0xd6, 0x38, 0x51, 0xc5, 0x98, 0x80, 0x80, 0xd2, 0x24,
0xc6, 0x17, 0xfb, 0x8f, 0x24, 0xe2, 0x96, 0x92, 0xf0, 0x9d, 0xfd, 0x00,
0x43, 0xed, 0x14, 0x9a, 0x2f, 0xc1, 0x18, 0x5a, 0xed, 0x81, 0xb5, 0x9e,
0xb7, 0x1c, 0xad, 0x72, 0x35, 0xdf, 0xd7, 0x8c, 0xfe, 0x77, 0x35, 0x14,
0x8b, 0x5c, 0xe7, 0x4d, 0xe9, 0xb3, 0x2a, 0x39, 0x83, 0xb7, 0x22, 0x6f,
0xa4, 0xbb, 0x3f, 0x88, 0xfe, 0x2f, 0xfa, 0xff, 0xd6, 0xc1, 0x7c, 0xc5,
0xd1, 0x3b, 0xd3, 0x61, 0xd9, 0x34, 0xd4, 0x9f, 0xb8, 0x30, 0x24, 0xd0,
0x8b, 0x32, 0xe5, 0x70, 0xdd, 0x8d, 0x5f, 0xcc, 0xf2, 0xf1, 0x3a, 0x9e,
0x4f, 0x31, 0x7f, 0x41, 0x63, 0xab, 0xe4, 0x29, 0xf1, 0xdb, 0xb6, 0xd0,
0xcf, 0x8a, 0x52, 0x27, 0xce, 0xc9, 0x10, 0xb1, 0x0a, 0xcd, 0x6a, 0x8c,
0x7e, 0x0a, 0xa5, 0x93, 0x97, 0x61, 0x85, 0x70, 0x24, 0xe2, 0x3a, 0x86,
0x05, 0x4b, 0x29, 0xb3, 0x4a, 0x48, 0xcc, 0xac, 0x79, 0x59, 0x8b, 0xa5,
0x3a, 0xaf, 0x09, 0x9d, 0x7f, 0xb8, 0x8c, 0x93, 0x3d, 0x55, 0xd4, 0xe9,
0x2a, 0x36, 0x0c, 0x2d, 0x8d, 0x47, 0x16, 0xb1, 0x90, 0xcb, 0x68, 0x7f,
0xe1, 0xf7, 0xcc, 0xe9, 0x91, 0x9a, 0xbf, 0x53, 0x04, 0x8c, 0xfb, 0xb6,
0x2a, 0x3c, 0x22, 0xd9, 0x8c, 0x45, 0x6f, 0xbb, 0x98, 0xee, 0x83, 0xf1,
0xc3, 0x98, 0xa3, 0x96, 0x30, 0x55, 0x59, 0x52, 0xb0, 0xb8, 0xea, 0xb7,
0x1d, 0xf4, 0xad, 0x07 };
X509Certificate2 cert = new X509Certificate2(der);
X509Chain chain = new X509Chain();
//chain.ChainPolicy.VerificationTime = new DateTime(2020, 05, 25);
chain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
chain.ChainPolicy.VerificationFlags = X509VerificationFlags.IgnoreNotTimeValid;
if (chain.Build(cert)) {
Console.WriteLine("Good. Go team!");
}
else {
Console.WriteLine(chain.ChainElements[0].ChainElementStatus[0].Status);
}
}
}This chain will not build successfully, and "NotTimeValid" is printed to the console, despite the verification flags specifying to ignore it. If you add the commented out line back for VerificationTime, the chain will build successfully.
This does not reproduce on Ubuntu 20.04 with 3.1.5.
Configuration
- macOS 10.15.5
- net5.0, 5.0.0-preview.7.20315.3
Regression?
No, reproduces in 2.1.19, 3.1.5 and 5.0.0-preview.7.20315.3
Activity
vcsjones commentedon Jun 17, 2020
@bartonjs before I dig in, is this known or expected due to some limitation of macOS? Otherwise I shall dig.
bartonjs commentedon Jun 17, 2020
Nope, doesn't sound familiar, dig away 😄.
vcsjones commentedon Jun 17, 2020
Okay I don't think this is a bug.. just a quirk, I guess?
The problem was this is an incomplete chain as well. That is why
Buildwas returning false, I just failed to notice that in the repro I threw together.The other issue is that when a chain issue is suppressed, the chain status isn't cleared out, and that threw me off. Here:
This will print "Good" and "NotTimeValid".
I couldn't reproduce it on Linux because the missing intermediate was not a problem.
bartonjs commentedon Jun 17, 2020
Yep, that confused me too, back when porting this stuff to non-Windows 😄.