Bug #71519 [NEW]: SSL Serial Number wildly wrong

From: xrobau at gmail dot com Operating system: CentOS 7.2 PHP version: 5.6.17 Package: OpenSSL related Bug Type: Bug Bug description:SSL Serial Number wildly wrong Description: ------------ When a certificate's serial number starts with a null, the serial number reported is wildly wrong. For example: -----BEGIN CERTIFICATE----- MIIEVzCCAz+gAwIBAgIVAJBE2ako0aG8TmE0MR3X60rpaxRoMA0GCSqGSIb3DQEB CwUAMIGhMQswCQYDVQQGEwJDQTEQMA4GA1UECAwHT250YXJpbzEcMBoGA1UECgwT U2FuZ29tYSBDb3Jwb3JhdGlvbjEVMBMGA1UECwwMUHJvdmlzaW9uaW5nMSYwJAYD VQQDDB1QaG9uZSBTaWduaW5nIEtleSAoMjAxNi0yMDE4KTEjMCEGCSqGSIb3DQEJ ARYUc2VjdXJpdHlAc2FuZ29tYS5jb20wHhcNMTYwMjAzMDYwNTAyWhcNMzYwMTI5 MDYwNTAyWjB1MQswCQYDVQQGEwJDQTEQMA4GA1UECAwHT250YXJpbzEQMA4GA1UE BwwHVG9yb250bzEQMA4GA1UECgwHU2FuZ29tYTEVMBMGA1UECwwMUHJvdmlzaW9u aW5nMRkwFwYDVQQDDBBNQUMtMDA1MDU4NTAwMTAwMIIBIjANBgkqhkiG9w0BAQEF AAOCAQ8AMIIBCgKCAQEA1owwYWRaOZceTr5Fa6iuUoBArWnQ5+JzdgA+qPCrbu0/ V87OpvIWRk+141D40xT278Ae4fExqsI/R+MQN5MQcGkWDWZ+t7Cr/QQVmtdcuoXQ NXM8VyaiHF8pfOs/wC9GE78Qnry/S5cPUt0S5DXgyzGADDTYwE0kC9P2RNrNvv6y /VkmJbwo+sW7540s9Zue4aaKCBQ8VVL9gBPNUt25+NL8gFIqmXY2Zoq/lnFEw3X2 3pjILimb5FVVqmYrKkQYG/KANBJBieYURX6htUnS6LS3fxcwaxFU0hIw/kVs8Bw0 76y41ii6p/LYQkGJdR/EjCauNvagqfTdnI9qlQJK4wIDAQABo4GwMIGtMAkGA1Ud EwQCMAAwEQYJYIZIAYb4QgEBBAQDAgeAMCgGCWCGSAGG+EIBDQQbFhlTYW5nb21h IFBob25lIENlcnRpZmljYXRlMB0GA1UdDgQWBBR703JYf9BRTQus+ZCS7G/ZJDdb mjAfBgNVHSMEGDAWgBRhRHZJs4QP8YONN/WWkAAls8liXDAOBgNVHQ8BAf8EBAMC BLAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggEBAEQKEeMk zJ2khQXqTmVQ45Y5GmV39YQsoKvIHd+UUypvQvrIAW3ETqq2MYpr+9H0UaofLMcC 9SSDAzuPgLSlQ/pD+EnAx7SFV4Z9uQoODJ6jy6Bed3lB7XnMuyiNZemlJlplT0UB le3W8BZkJJ8evBPY3xlmih+IWE71bpD5o7zehY0F3iMGTEAM79xORu16dgYsWfNR xA5lZ3VqszNJIlva1jcFxyK7JgYwTAh+E5QL9w5HuFyWxfhwiuHARGzan2My4hkB xzEkyWB8rcfqB4WlLumbxdBgOPBrmz0mVqCW1Akz3jmOwM/Xn84KKey6kO5S8zSe oOvl9VZbYyXMaPo= -----END CERTIFICATE----- The certificate serial number starts with 00:90:44, and openssl (correctly) drops the leading zeros: [user@dev ~]$ openssl x509 -in test.crt -noout -serial serial=9044D9A928D1A1BC4E6134311DD7EB4AE96B1468 [user@dev ~]$ Mozilla, on the other hand, displays the Serial number with its leading zeros: http://imgur.com/GN7Y43M [user@dev ~]$ php fail.php Serial should be 9044D9A928D1A1BC4E6134311DD7EB4AE96B1468 or 009044D9A928D1A1BC4E6134311DD7EB4AE96B1468: Serial reported as: '823630082600157765737248287472764421210987238504' [user@dev ~]$ Test script: --------------- $cert="-----BEGIN CERTIFICATE----- MIIEVzCCAz+gAwIBAgIVAJBE2ako0aG8TmE0MR3X60rpaxRoMA0GCSqGSIb3DQEB CwUAMIGhMQswCQYDVQQGEwJDQTEQMA4GA1UECAwHT250YXJpbzEcMBoGA1UECgwT U2FuZ29tYSBDb3Jwb3JhdGlvbjEVMBMGA1UECwwMUHJvdmlzaW9uaW5nMSYwJAYD VQQDDB1QaG9uZSBTaWduaW5nIEtleSAoMjAxNi0yMDE4KTEjMCEGCSqGSIb3DQEJ ARYUc2VjdXJpdHlAc2FuZ29tYS5jb20wHhcNMTYwMjAzMDYwNTAyWhcNMzYwMTI5 MDYwNTAyWjB1MQswCQYDVQQGEwJDQTEQMA4GA1UECAwHT250YXJpbzEQMA4GA1UE BwwHVG9yb250bzEQMA4GA1UECgwHU2FuZ29tYTEVMBMGA1UECwwMUHJvdmlzaW9u aW5nMRkwFwYDVQQDDBBNQUMtMDA1MDU4NTAwMTAwMIIBIjANBgkqhkiG9w0BAQEF AAOCAQ8AMIIBCgKCAQEA1owwYWRaOZceTr5Fa6iuUoBArWnQ5+JzdgA+qPCrbu0/ V87OpvIWRk+141D40xT278Ae4fExqsI/R+MQN5MQcGkWDWZ+t7Cr/QQVmtdcuoXQ NXM8VyaiHF8pfOs/wC9GE78Qnry/S5cPUt0S5DXgyzGADDTYwE0kC9P2RNrNvv6y /VkmJbwo+sW7540s9Zue4aaKCBQ8VVL9gBPNUt25+NL8gFIqmXY2Zoq/lnFEw3X2 3pjILimb5FVVqmYrKkQYG/KANBJBieYURX6htUnS6LS3fxcwaxFU0hIw/kVs8Bw0 76y41ii6p/LYQkGJdR/EjCauNvagqfTdnI9qlQJK4wIDAQABo4GwMIGtMAkGA1Ud EwQCMAAwEQYJYIZIAYb4QgEBBAQDAgeAMCgGCWCGSAGG+EIBDQQbFhlTYW5nb21h IFBob25lIENlcnRpZmljYXRlMB0GA1UdDgQWBBR703JYf9BRTQus+ZCS7G/ZJDdb mjAfBgNVHSMEGDAWgBRhRHZJs4QP8YONN/WWkAAls8liXDAOBgNVHQ8BAf8EBAMC BLAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggEBAEQKEeMk zJ2khQXqTmVQ45Y5GmV39YQsoKvIHd+UUypvQvrIAW3ETqq2MYpr+9H0UaofLMcC 9SSDAzuPgLSlQ/pD+EnAx7SFV4Z9uQoODJ6jy6Bed3lB7XnMuyiNZemlJlplT0UB le3W8BZkJJ8evBPY3xlmih+IWE71bpD5o7zehY0F3iMGTEAM79xORu16dgYsWfNR xA5lZ3VqszNJIlva1jcFxyK7JgYwTAh+E5QL9w5HuFyWxfhwiuHARGzan2My4hkB xzEkyWB8rcfqB4WlLumbxdBgOPBrmz0mVqCW1Akz3jmOwM/Xn84KKey6kO5S8zSe oOvl9VZbYyXMaPo= -----END CERTIFICATE-----"; $x509 = openssl_x509_parse($cert); print "Serial should be 9044D9A928D1A1BC4E6134311DD7EB4AE96B1468 or 009044D9A928D1A1BC4E6134311DD7EB4AE96B1468:\n"; print "Serial reported as: '".$x509['serialNumber']."'\n"; -- Edit bug report at https://bugs.php.net/bug.php?id=71519&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=71519&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=71519&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=71519&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=71519&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=71519&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=71519&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=71519&r=needscript Try newer version: https://bugs.php.net/fix.php?id=71519&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=71519&r=support Expected behavior: https://bugs.php.net/fix.php?id=71519&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=71519&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=71519&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=71519&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=71519&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=71519&r=dst IIS Stability: https://bugs.php.net/fix.php?id=71519&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=71519&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=71519&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=71519&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=71519&r=mysqlcfg