Bug #71519 [Com]: SSL Serial Number wildly wrong

Edit report at https://bugs.php.net/bug.php?id=71519&edit=1 ID: 71519 Comment by: xrobau at gmail dot com Reported by: xrobau at gmail dot com Summary: SSL Serial Number wildly wrong Status: Open Type: Bug Package: OpenSSL related Operating System: CentOS 7.2 PHP Version: 5.6.17 Block user comment: N Private report: N New Comment: Additional information: This appears to be related to long-forgotten bug https://bugs.php.net/bug.php?id=52093 After doing some further diagnosis after reporting the bug, I tried doing a dechex on the number provided by serialNumber, and that immediately exposed an overflow there: $ php fail.php Serial should be 9044D9A928D1A1BC4E6134311DD7EB4AE96B1468 or 009044D9A928D1A1BC4E6134311DD7EB4AE96B1468: Serial reported as: '7fffffffffffffff' $ Additionally, as I didn't make it clear in the original report, the leading byte of a serial number being zero means that the serial number is to be reported as hex, not interpreted as a decimal number. Previous Comments: ------------------------------------------------------------------------ [2016-02-04 04:17:07] xrobau at gmail dot com Appears to be related to 2010-era-bug https://bugs.php.net/bug.php?id=52093 ------------------------------------------------------------------------ [2016-02-04 04:14:42] xrobau at gmail dot com Note to clarify: The first byte of the serial number being 00 specifically means that the serial number is a hex digit, and should be reported as such. However, there is an overflow in the serial number code. This is obvious when doing a dechex() on the number returned: $ php fail.php Serial should be 9044D9A928D1A1BC4E6134311DD7EB4AE96B1468 or 009044D9A928D1A1BC4E6134311DD7EB4AE96B1468: Serial reported as: '7fffffffffffffff' ------------------------------------------------------------------------ [2016-02-04 03:17:08] xrobau at gmail dot com Description: ------------ When a certificate's serial number starts with a null, the serial number reported is wildly wrong. For example: -----BEGIN CERTIFICATE----- MIIEVzCCAz+gAwIBAgIVAJBE2ako0aG8TmE0MR3X60rpaxRoMA0GCSqGSIb3DQEB CwUAMIGhMQswCQYDVQQGEwJDQTEQMA4GA1UECAwHT250YXJpbzEcMBoGA1UECgwT U2FuZ29tYSBDb3Jwb3JhdGlvbjEVMBMGA1UECwwMUHJvdmlzaW9uaW5nMSYwJAYD VQQDDB1QaG9uZSBTaWduaW5nIEtleSAoMjAxNi0yMDE4KTEjMCEGCSqGSIb3DQEJ ARYUc2VjdXJpdHlAc2FuZ29tYS5jb20wHhcNMTYwMjAzMDYwNTAyWhcNMzYwMTI5 MDYwNTAyWjB1MQswCQYDVQQGEwJDQTEQMA4GA1UECAwHT250YXJpbzEQMA4GA1UE BwwHVG9yb250bzEQMA4GA1UECgwHU2FuZ29tYTEVMBMGA1UECwwMUHJvdmlzaW9u aW5nMRkwFwYDVQQDDBBNQUMtMDA1MDU4NTAwMTAwMIIBIjANBgkqhkiG9w0BAQEF AAOCAQ8AMIIBCgKCAQEA1owwYWRaOZceTr5Fa6iuUoBArWnQ5+JzdgA+qPCrbu0/ V87OpvIWRk+141D40xT278Ae4fExqsI/R+MQN5MQcGkWDWZ+t7Cr/QQVmtdcuoXQ NXM8VyaiHF8pfOs/wC9GE78Qnry/S5cPUt0S5DXgyzGADDTYwE0kC9P2RNrNvv6y /VkmJbwo+sW7540s9Zue4aaKCBQ8VVL9gBPNUt25+NL8gFIqmXY2Zoq/lnFEw3X2 3pjILimb5FVVqmYrKkQYG/KANBJBieYURX6htUnS6LS3fxcwaxFU0hIw/kVs8Bw0 76y41ii6p/LYQkGJdR/EjCauNvagqfTdnI9qlQJK4wIDAQABo4GwMIGtMAkGA1Ud EwQCMAAwEQYJYIZIAYb4QgEBBAQDAgeAMCgGCWCGSAGG+EIBDQQbFhlTYW5nb21h IFBob25lIENlcnRpZmljYXRlMB0GA1UdDgQWBBR703JYf9BRTQus+ZCS7G/ZJDdb mjAfBgNVHSMEGDAWgBRhRHZJs4QP8YONN/WWkAAls8liXDAOBgNVHQ8BAf8EBAMC BLAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggEBAEQKEeMk zJ2khQXqTmVQ45Y5GmV39YQsoKvIHd+UUypvQvrIAW3ETqq2MYpr+9H0UaofLMcC 9SSDAzuPgLSlQ/pD+EnAx7SFV4Z9uQoODJ6jy6Bed3lB7XnMuyiNZemlJlplT0UB le3W8BZkJJ8evBPY3xlmih+IWE71bpD5o7zehY0F3iMGTEAM79xORu16dgYsWfNR xA5lZ3VqszNJIlva1jcFxyK7JgYwTAh+E5QL9w5HuFyWxfhwiuHARGzan2My4hkB xzEkyWB8rcfqB4WlLumbxdBgOPBrmz0mVqCW1Akz3jmOwM/Xn84KKey6kO5S8zSe oOvl9VZbYyXMaPo= -----END CERTIFICATE----- The certificate serial number starts with 00:90:44, and openssl (correctly) drops the leading zeros: [user@dev ~]$ openssl x509 -in test.crt -noout -serial serial=9044D9A928D1A1BC4E6134311DD7EB4AE96B1468 [user@dev ~]$ Mozilla, on the other hand, displays the Serial number with its leading zeros: http://imgur.com/GN7Y43M [user@dev ~]$ php fail.php Serial should be 9044D9A928D1A1BC4E6134311DD7EB4AE96B1468 or 009044D9A928D1A1BC4E6134311DD7EB4AE96B1468: Serial reported as: '823630082600157765737248287472764421210987238504' [user@dev ~]$ Test script: --------------- $cert="-----BEGIN CERTIFICATE----- MIIEVzCCAz+gAwIBAgIVAJBE2ako0aG8TmE0MR3X60rpaxRoMA0GCSqGSIb3DQEB CwUAMIGhMQswCQYDVQQGEwJDQTEQMA4GA1UECAwHT250YXJpbzEcMBoGA1UECgwT U2FuZ29tYSBDb3Jwb3JhdGlvbjEVMBMGA1UECwwMUHJvdmlzaW9uaW5nMSYwJAYD VQQDDB1QaG9uZSBTaWduaW5nIEtleSAoMjAxNi0yMDE4KTEjMCEGCSqGSIb3DQEJ ARYUc2VjdXJpdHlAc2FuZ29tYS5jb20wHhcNMTYwMjAzMDYwNTAyWhcNMzYwMTI5 MDYwNTAyWjB1MQswCQYDVQQGEwJDQTEQMA4GA1UECAwHT250YXJpbzEQMA4GA1UE BwwHVG9yb250bzEQMA4GA1UECgwHU2FuZ29tYTEVMBMGA1UECwwMUHJvdmlzaW9u aW5nMRkwFwYDVQQDDBBNQUMtMDA1MDU4NTAwMTAwMIIBIjANBgkqhkiG9w0BAQEF AAOCAQ8AMIIBCgKCAQEA1owwYWRaOZceTr5Fa6iuUoBArWnQ5+JzdgA+qPCrbu0/ V87OpvIWRk+141D40xT278Ae4fExqsI/R+MQN5MQcGkWDWZ+t7Cr/QQVmtdcuoXQ NXM8VyaiHF8pfOs/wC9GE78Qnry/S5cPUt0S5DXgyzGADDTYwE0kC9P2RNrNvv6y /VkmJbwo+sW7540s9Zue4aaKCBQ8VVL9gBPNUt25+NL8gFIqmXY2Zoq/lnFEw3X2 3pjILimb5FVVqmYrKkQYG/KANBJBieYURX6htUnS6LS3fxcwaxFU0hIw/kVs8Bw0 76y41ii6p/LYQkGJdR/EjCauNvagqfTdnI9qlQJK4wIDAQABo4GwMIGtMAkGA1Ud EwQCMAAwEQYJYIZIAYb4QgEBBAQDAgeAMCgGCWCGSAGG+EIBDQQbFhlTYW5nb21h IFBob25lIENlcnRpZmljYXRlMB0GA1UdDgQWBBR703JYf9BRTQus+ZCS7G/ZJDdb mjAfBgNVHSMEGDAWgBRhRHZJs4QP8YONN/WWkAAls8liXDAOBgNVHQ8BAf8EBAMC BLAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggEBAEQKEeMk zJ2khQXqTmVQ45Y5GmV39YQsoKvIHd+UUypvQvrIAW3ETqq2MYpr+9H0UaofLMcC 9SSDAzuPgLSlQ/pD+EnAx7SFV4Z9uQoODJ6jy6Bed3lB7XnMuyiNZemlJlplT0UB le3W8BZkJJ8evBPY3xlmih+IWE71bpD5o7zehY0F3iMGTEAM79xORu16dgYsWfNR xA5lZ3VqszNJIlva1jcFxyK7JgYwTAh+E5QL9w5HuFyWxfhwiuHARGzan2My4hkB xzEkyWB8rcfqB4WlLumbxdBgOPBrmz0mVqCW1Akz3jmOwM/Xn84KKey6kO5S8zSe oOvl9VZbYyXMaPo= -----END CERTIFICATE-----"; $x509 = openssl_x509_parse($cert); print "Serial should be 9044D9A928D1A1BC4E6134311DD7EB4AE96B1468 or 009044D9A928D1A1BC4E6134311DD7EB4AE96B1468:\n"; print "Serial reported as: '".$x509['serialNumber']."'\n"; ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=71519&edit=1