About the security content of iOS 7.0.6

Re:About the security content of iOS 7.0.6 by noclip on Friday February 21, 2014 @06:58PM (#7280293)

It's not just cURL. It's much bigger, and much worse.

[ Parent | on HN ]

Re:About the security content of iOS 7.0.6 by croikle on Friday February 21, 2014 @09:50PM (#7280790)

So, I'm not sure about that one. Apparently s_client ignores the error and completes the connection because it's intended to be used for debugging.

> Currently the verify operation continues after errors so all the problems with a certificate chain can be seen. As a side effect the connection will never fail due to a server certificate verify failure.

https://www.openssl.org/docs/apps/s_client.html

https://www.mail-archive.com/[email protected]/msg71...

[ Parent | on HN ]

Re:About the security content of iOS 7.0.6 by noclip on Friday February 21, 2014 @10:07PM (#7280835)

The s_client connection continues but should still report a verify error. On Linux:

http://pastebin.com/QWpSrR5p

[ Parent | on HN ]

Re:About the security content of iOS 7.0.6 by teraflop on Friday February 21, 2014 @07:18PM (#7280366)

I don't know what you think that pastebin shows, but that error is not specific to OS X or to ssl.apple.com. OpenSSL is failing to validate the server certificate because you forgot to specify the -CAfile option.

EDIT: I'm an idiot, see below.

[ Parent | on HN ]

Re:About the security content of iOS 7.0.6 by noclip on Friday February 21, 2014 @07:19PM (#7280368)

Except it isn't failing.

[ Parent | on HN ]

Re:About the security content of iOS 7.0.6 by teraflop on Friday February 21, 2014 @07:23PM (#7280379)

Oh wow, you're right, sorry. I saw the error code at the top, and missed the fact that it was reporting success anyway at the bottom. That's... pretty terrible.

[ Parent | on HN ]