Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Groups
  • Search
  • Get Qt Extensions
  • Unsolved
Collapse
Brand Logo
  1. Home
  2. Qt Development
  3. General and Desktop
  4. QSslSocket how to dump an expired certificate?
Forum Updated to NodeBB v4.3 + New Features

QSslSocket how to dump an expired certificate?

Scheduled Pinned Locked Moved Solved General and Desktop
14 Posts 4 Posters 1.2k Views 2 Watching
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • mbruelM Offline
    mbruelM Offline
    mbruel
    wrote on last edited by
    #2

    well I've dumped both local and peer certificate instead of the one attached to the QSslError:

           ostream << "SSL Peer Certificate: \n" << static_cast<QSslSocket*>(iSocket)->peerCertificate().toText();
       ostream << "SSL Local Certificate: \n" << static_cast<QSslSocket*>(iSocket)->localCertificate().toText();

    But they don't look expired...

    SSL Peer Certificate: 
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:66:b3:fb:70:06:33:7d:f8:6c:d8:d5:2d:7a:74:f7:68:87
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, O=Let's Encrypt, CN=R3
        Validity
            Not Before: Sep 27 15:21:15 2021 GMT
            Not After : Dec 26 15:21:14 2021 GMT
...

SSL Local Certificate: 
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            f2:e7:4b:2c:57:fb:87:14
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=FR, ST=Some-State, L=Paris, O=XXXX
        Validity
            Not Before: Dec  2 21:50:15 2015 GMT
            Not After : Nov 29 21:50:15 2025 GMT
...

    any idea why I got this QSslError::CertificateExpired ?

    1 Reply Last reply
    0
    • SGaistS Offline
      SGaistS Offline
      SGaist
      Lifetime Qt Champion
      wrote on last edited by
      #3

      Hi,

      Did you check the intermediate certificates ?

      Interested in AI ? www.idiap.ch
      Please read the Qt Code of Conduct - https://forum.qt.io/topic/113070/qt-code-of-conduct

      1 Reply Last reply
      0
      • mbruelM Offline
        mbruelM Offline
        mbruel
        wrote on last edited by
        #4

        I'm not an expert on SSL handshake... I thought there was just one certificate each side for all the negociation.
        How can I print them (intermediate ones) and find out the one that is expired so I could report it to the provider (server)?
        That's a shame that the certificate linked to the QSslError is empty...

        1 Reply Last reply
        0
        • SGaistS Offline
          SGaistS Offline
          SGaist
          Lifetime Qt Champion
          wrote on last edited by
          #5

          You should use the OpenSSL command directly for that.

          See this stack overflow answer to see how to do it.

          Interested in AI ? www.idiap.ch
          Please read the Qt Code of Conduct - https://forum.qt.io/topic/113070/qt-code-of-conduct

          1 Reply Last reply
          0
          • mbruelM Offline
            mbruelM Offline
            mbruel
            wrote on last edited by
            #6

            ok thanks,
            following your link I managed using openssl to get twice the same certificate and still the same validity dates:

            Validity
            Not Before: Sep 27 15:21:15 2021 GMT
            Not After : Dec 26 15:21:14 2021 GMT

            still don't understand why Qt raises me a QSslError::CertificateExpired... :$

            1 Reply Last reply
            0
            • SGaistS Offline
              SGaistS Offline
              SGaist
              Lifetime Qt Champion
              wrote on last edited by
              #7

              Did you get the full chains of certificates up to the CA ?

              Interested in AI ? www.idiap.ch
              Please read the Qt Code of Conduct - https://forum.qt.io/topic/113070/qt-code-of-conduct

              mbruelM 1 Reply Last reply
              0
              • SGaistS SGaist

                Did you get the full chains of certificates up to the CA ?

                mbruelM Offline
                mbruelM Offline
                mbruel
                wrote on last edited by
                #8

                @SGaist not sure how to do it. I've tried several commands from your link but I ended up with just one certificate.
                If you want to give it a try I'm targetting news.usenetserver.com:563
                echo "" | openssl s_client -connect news.usenetserver.com:563 -prexit 2>/dev/null gives me twice the same certificate.
                I got the full details (validity dates) using echo | openssl s_client -servername news.usenetserver.com -connect news.usenetserver.com:563 2>/dev/null | openssl x509 -text

                Pablo J. RoginaP 1 Reply Last reply
                0
                • mbruelM mbruel

                  Hi,
                  a server I'm connecting to seems to have an expired certificate.

                  Here is my code to handle it and continue the connection:

                  void Connection::onSslErrors(const QList<QSslError> &errors){
    QTextStream &ostream = NntpProxy::acquireLog(iLogPrefix);
    ostream << "Error SSL Socket:\n";
    for(int i=0;i<errors.size();i++)
        ostream << "\t- #" << errors[i].error() << " : " <<  errors[i].errorString() << "\n";
    NntpProxy::releaseLog();

    if (errors.size() == 1 && errors.first().error() == QSslError::CertificateExpired){
        static_cast<QSslSocket*>(iSocket)->ignoreSslErrors();
        QTextStream &ostream = NntpProxy::acquireLog(iLogPrefix);
        ostream << "Ignored SSL Certificate:\n";
        ostream << errors.first().certificate().toText();
        NntpProxy::releaseLog();
    }
    else
        emit socketError("SSL error...");
}

                  I'm getting this log:

                  [2021/10/19 22:44:14] [Thread 0x7fe6d8f17700] NntpConnection[13] Serv[0] Error SSL Socket:
        - #6 : The certificate has expired
[2021/10/19 22:44:14] [Thread 0x7fe6d8f17700] NntpConnection[13] Serv[0] Ignored SSL Certificate:

                  So the certificate is not dumped, I get nothing with QSslError::certificate().toText()

                  Where would be a good place and how can I dump the SSL certificate?

                  jeremy_kJ Offline
                  jeremy_kJ Offline
                  jeremy_k
                  wrote on last edited by
                  #9

                  @mbruel said in QSslSocket how to dump an expired certificate?:

                  Hi,
                  a server I'm connecting to seems to have an expired certificate.

                  Here is my code to handle it and continue the connection:

                  void Connection::onSslErrors(const QList<QSslError> &errors){
    QTextStream &ostream = NntpProxy::acquireLog(iLogPrefix);
    ostream << "Error SSL Socket:\n";
    for(int i=0;i<errors.size();i++)
        ostream << "\t- #" << errors[i].error() << " : " <<  errors[i].errorString() << "\n";
    NntpProxy::releaseLog();

    if (errors.size() == 1 && errors.first().error() == QSslError::CertificateExpired){

                  So the certificate is not dumped, I get nothing with QSslError::certificate().toText()

                  The if clause that calls QSslCertificate::toText() isn't taken because there are two certificates (based on the posted output), but the code checks errors().size() == 1.

                  Where would be a good place and how can I dump the SSL certificate?

                  Have you tried QSslSocket::peerCertificateChain rather than QSslSocket::peerCertificate?

                  Asking a question about code? http://eel.is/iso-c++/testcase/

                  mbruelM 1 Reply Last reply
                  2
                  • mbruelM mbruel

                    @SGaist not sure how to do it. I've tried several commands from your link but I ended up with just one certificate.
                    If you want to give it a try I'm targetting news.usenetserver.com:563
                    echo "" | openssl s_client -connect news.usenetserver.com:563 -prexit 2>/dev/null gives me twice the same certificate.
                    I got the full details (validity dates) using echo | openssl s_client -servername news.usenetserver.com -connect news.usenetserver.com:563 2>/dev/null | openssl x509 -text

                    Pablo J. RoginaP Offline
                    Pablo J. RoginaP Offline
                    Pablo J. Rogina
                    wrote on last edited by Pablo J. Rogina
                    #10

                    Check certificate chain:

                    $ openssl s_client -showcerts -verify 5 -connect news.usenetserver.com:563 < /dev/null

                    At the top, you'll see that there are 3 certificates involved, listed from root to your desired target:

                    depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = usenetserver.com
verify return:1

                    In the command output you'll have also the 3 certificates dumped. If you copy and save such information to text files, removing the EOL chars (just to have a whole line between markers ----- BEGIN CERTIFICATE ------ and ----- END CERTIFICATE ------ you can have details from each certificate:

                    $ openssl x509 -inform pem -in usenetserver.cer -noout -text | grep -i after
            Not After : Dec 26 15:21:14 2021 GMT
$ openssl x509 -inform pem -in lets_encrypt_R3.cer -noout -text | grep -i after
            Not After : Sep 15 16:00:00 2025 GMT
$ openssl x509 -inform pem -in lets_encrypt_Root.cer -noout -text | grep -i after
            Not After : Sep 30 18:14:03 2024 GMT

                    So yes, none of the certificates in the chain seem to be expired.
                    You may want to check Qt source code (I haven't) just in case the current code is not able to follow a chain of certificates

                    Upvote the answer(s) that helped you solve the issue
                    Use "Topic Tools" button to mark your post as Solved
                    Add screenshots via postimage.org
                    Don't ask support requests via chat/PM. Please use the forum so others can benefit from the solution in the future

                    1 Reply Last reply
                    2
                    • jeremy_kJ jeremy_k

                      @mbruel said in QSslSocket how to dump an expired certificate?:

                      Hi,
                      a server I'm connecting to seems to have an expired certificate.

                      Here is my code to handle it and continue the connection:

                      void Connection::onSslErrors(const QList<QSslError> &errors){
    QTextStream &ostream = NntpProxy::acquireLog(iLogPrefix);
    ostream << "Error SSL Socket:\n";
    for(int i=0;i<errors.size();i++)
        ostream << "\t- #" << errors[i].error() << " : " <<  errors[i].errorString() << "\n";
    NntpProxy::releaseLog();

    if (errors.size() == 1 && errors.first().error() == QSslError::CertificateExpired){

                      So the certificate is not dumped, I get nothing with QSslError::certificate().toText()

                      The if clause that calls QSslCertificate::toText() isn't taken because there are two certificates (based on the posted output), but the code checks errors().size() == 1.

                      Where would be a good place and how can I dump the SSL certificate?

                      Have you tried QSslSocket::peerCertificateChain rather than QSslSocket::peerCertificate?

                      mbruelM Offline
                      mbruelM Offline
                      mbruel
                      wrote on last edited by
                      #11

                      @jeremy_k said in QSslSocket how to dump an expired certificate?:

                      Have you tried QSslSocket::peerCertificateChain rather than QSslSocket::peerCertificate?

                      No I didn't but just tried. I made a simple project: testSslSock
                      The syntax is simple 3 args to connect to a Host with SSL.
                      In fact, I'm getting the same QSslError::CertificateExpired whatever the host...

                      I've to precise that this is happening on Qt v5.8.0 with QMake v3.1 and libssl.so.1.0.0. It's NOT happening on my normal env with Qt5.15 and libssl 1.1.

                      This wasn't happening before... Like one or 2 months ago...
                      The code didn't change and wasn't recompile.
                      This error just started to happen.
                      Any idea?
                      (PS: it's an app running on an old Debian 8.11)

                      cf my output:

                      $ ./testSslSock news.usenetserver.com 563 1
> Starting connection to news.usenetserver.com:563
> Connected to server
> Starting SSL Handshake
Error SSL Socket:
	- #6 : The certificate has expired
Ignored SSL Certificate:
nb Certificates: 3
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:66:b3:fb:70:06:33:7d:f8:6c:d8:d5:2d:7a:74:f7:68:87
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, O=Let's Encrypt, CN=R3
        Validity
            Not Before: Sep 27 15:21:15 2021 GMT
            Not After : Dec 26 15:21:14 2021 GMT
        Subject: CN=usenetserver.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Modulus:
                    00:b7:ec:24:29:a9:36:a7:f0:c5:e2:f1:30:23:79:
                    29:e0:24:71:e0:d2:4d:90:92:0d:cb:3e:76:f8:3e:
                    04:ae:3f:45:ea:f3:9f:b9:44:b0:aa:9b:85:2f:37:
                    b0:e0:24:9c:97:1b:da:48:b0:b8:4c:93:48:9d:f0:
                    bc:c0:17:42:f8:1a:79:02:e7:16:53:9a:80:c3:aa:
                    8c:34:9f:5a:0a:72:c5:5b:32:9d:e0:41:b8:65:c6:
                    62:d3:6c:d0:ad:e8:c5:32:4b:f3:91:41:5f:df:95:
                    0d:3b:e3:cb:8d:0a:bc:f4:1c:94:d7:4c:83:96:17:
                    62:89:1c:55:d0:b0:90:31:39:f3:60:6a:74:9f:77:
                    35:ae:b4:f6:79:39:68:98:2d:f7:c6:76:d4:a4:4c:
                    a4:e4:e9:78:7c:dc:0f:f0:8b:31:9b:99:4e:bd:92:
                    c7:64:97:2b:09:0a:33:ad:b0:c0:8d:a0:6a:7a:3e:
                    34:5a:b8:d9:04:93:3a:1c:7f:fc:a2:6d:9b:8e:34:
                    ee:2d:a6:e8:ee:59:af:5d:56:71:b2:21:75:84:99:
                    d9:37:e2:33:67:fd:b0:76:7f:db:c6:cc:3a:09:1b:
                    01:ac:b4:27:b6:1c:c8:38:4a:21:79:cd:26:e8:5c:
                    08:43:fb:1a:61:40:1d:f7:bb:83:4c:24:a9:7f:88:
                    00:24:fb:16:51:33:48:50:43:5e:95:e3:15:29:95:
                    b6:4f:f6:99:ea:20:97:fb:42:ad:76:b5:57:62:18:
                    57:89:5c:5c:cf:61:09:b6:e3:4b:98:1b:3b:de:e0:
                    c5:09:72:fe:4c:f4:e5:f0:0d:b9:ba:04:0e:95:3e:
                    83:81:90:9b:ee:ba:83:84:7d:a1:7c:35:bd:c9:23:
                    99:ab:cb:f2:76:31:3e:14:38:05:03:c9:f8:c6:8c:
                    88:e1:6b:c6:2d:46:65:e6:43:96:ec:90:e6:54:24:
                    e8:cf:d7:d9:ee:b5:66:92:6c:8b:4d:0b:b1:db:10:
                    71:b2:8f:ce:03:04:71:ed:ea:c2:0f:76:bd:c9:1e:
                    e1:89:b3:76:2c:c0:08:9b:bd:95:f1:ce:ce:35:8a:
                    4b:83:50:60:6c:5a:e5:80:8d:84:e0:2d:1a:20:67:
                    15:7a:96:b3:8a:81:e9:ec:ed:6e:49:8d:8f:0c:44:
                    bf:07:2c:9e:7e:72:b9:f7:9a:69:ed:1e:47:75:76:
                    f8:db:56:7c:00:3e:33:cc:cf:d1:a6:3e:74:59:ef:
                    b6:94:24:f0:30:37:f4:b1:25:4d:0a:69:c9:1b:b7:
                    f0:9c:ee:db:a4:2f:31:5e:51:c3:ad:ab:dd:01:07:
                    a0:3e:43:9e:d4:b3:d8:aa:e4:45:d7:76:64:e0:f8:
                    71:68:b1
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Key Identifier: 
                11:EF:B4:08:87:43:98:9F:81:17:0A:B6:CB:67:5B:A5:3F:3E:33:04
            X509v3 Authority Key Identifier: 
                keyid:14:2E:B3:17:B7:58:56:CB:AE:50:09:40:E6:1F:AF:9D:8B:14:C2:C6

            Authority Information Access: 
                OCSP - URI:http://r3.o.lencr.org
                CA Issuers - URI:http://r3.i.lencr.org/

            X509v3 Subject Alternative Name: 
                DNS:*.ams.usenetserver.com, DNS:*.eu.usenetserver.com, DNS:*.fr7.usenetserver.com, DNS:*.iad.usenetserver.com, DNS:*.usenetserver.com, DNS:usenetserver.com
            X509v3 Certificate Policies: 
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.44947.1.1.1
                  CPS: http://cps.letsencrypt.org

            1.3.6.1.4.1.11129.2.4.2: 
                ......v.D.e......@....(.......1.?.3........|(.|v.....G0E. ....p.......c....+yd,...z.2.iN...!........%t|..%TU.:.h........l..E..w.}>.....Uh$....R.y+..x...j.h.~".....|(.}......H0F.!...n.7...@Jz..K..... .........YA..!...1.....x....rT.>.s#7...y.......
    Signature Algorithm: sha256WithRSAEncryption
         77:4c:78:16:c3:9d:5b:31:4b:47:06:63:30:98:c4:0e:e1:09:
         d7:39:74:b1:57:fa:27:03:74:73:3a:81:52:b7:41:1a:7c:d6:
         7a:b4:e1:7c:cf:cd:0a:79:46:d0:21:6a:bb:49:6d:97:df:43:
         e4:b0:ac:dc:62:ea:ed:0a:e6:b8:5c:df:64:34:ba:fb:f5:e4:
         51:f4:4a:ad:eb:0c:67:c6:04:e1:84:54:6a:3d:77:3a:bb:64:
         b4:40:3a:33:ca:bd:6e:7d:11:06:41:86:5e:df:8a:ae:d4:ee:
         d2:0c:e7:f8:d8:e3:eb:6a:c2:78:fd:df:f4:67:96:68:dd:51:
         ef:96:c3:ec:7c:7c:b0:85:c7:c2:97:21:34:34:95:fd:f8:91:
         5f:7b:8b:d8:00:0b:bc:a9:8d:d4:87:5f:68:f3:26:ac:26:eb:
         b5:71:8d:0d:cc:c5:fe:72:fa:e2:c1:95:3c:ed:57:8c:cb:e9:
         b5:51:ff:35:f1:46:2e:32:9b:eb:8e:6c:f4:93:66:bf:67:44:
         02:b9:bb:14:1a:dc:4b:e0:25:1a:b7:f9:f4:9c:96:90:6c:c1:
         bb:62:54:9c:eb:86:b0:db:71:16:31:76:bc:7c:4e:9c:33:12:
         af:49:7d:97:57:7e:4b:41:b6:98:db:12:d4:0c:17:2a:ae:6b:
         a9:13:03:a4
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            91:2b:08:4a:cf:0c:18:a7:53:f6:d6:2e:25:a7:5f:5a
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, O=Internet Security Research Group, CN=ISRG Root X1
        Validity
            Not Before: Sep  4 00:00:00 2020 GMT
            Not After : Sep 15 16:00:00 2025 GMT
        Subject: C=US, O=Let's Encrypt, CN=R3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:bb:02:15:28:cc:f6:a0:94:d3:0f:12:ec:8d:55:
                    92:c3:f8:82:f1:99:a6:7a:42:88:a7:5d:26:aa:b5:
                    2b:b9:c5:4c:b1:af:8e:6b:f9:75:c8:a3:d7:0f:47:
                    94:14:55:35:57:8c:9e:a8:a2:39:19:f5:82:3c:42:
                    a9:4e:6e:f5:3b:c3:2e:db:8d:c0:b0:5c:f3:59:38:
                    e7:ed:cf:69:f0:5a:0b:1b:be:c0:94:24:25:87:fa:
                    37:71:b3:13:e7:1c:ac:e1:9b:ef:db:e4:3b:45:52:
                    45:96:a9:c1:53:ce:34:c8:52:ee:b5:ae:ed:8f:de:
                    60:70:e2:a5:54:ab:b6:6d:0e:97:a5:40:34:6b:2b:
                    d3:bc:66:eb:66:34:7c:fa:6b:8b:8f:57:29:99:f8:
                    30:17:5d:ba:72:6f:fb:81:c5:ad:d2:86:58:3d:17:
                    c7:e7:09:bb:f1:2b:f7:86:dc:c1:da:71:5d:d4:46:
                    e3:cc:ad:25:c1:88:bc:60:67:75:66:b3:f1:18:f7:
                    a2:5c:e6:53:ff:3a:88:b6:47:a5:ff:13:18:ea:98:
                    09:77:3f:9d:53:f9:cf:01:e5:f5:a6:70:17:14:af:
                    63:a4:ff:99:b3:93:9d:dc:53:a7:06:fe:48:85:1d:
                    a1:69:ae:25:75:bb:13:cc:52:03:f5:ed:51:a1:8b:
                    db:15
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier: 
                14:2E:B3:17:B7:58:56:CB:AE:50:09:40:E6:1F:AF:9D:8B:14:C2:C6
            X509v3 Authority Key Identifier: 
                keyid:79:B4:59:E6:7B:B6:E5:E4:01:73:80:08:88:C8:1A:58:F6:E9:9B:6E

            Authority Information Access: 
                CA Issuers - URI:http://x1.i.lencr.org/

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://x1.c.lencr.org/

            X509v3 Certificate Policies: 
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.44947.1.1.1

    Signature Algorithm: sha256WithRSAEncryption
         85:ca:4e:47:3e:a3:f7:85:44:85:bc:d5:67:78:b2:98:63:ad:
         75:4d:1e:96:3d:33:65:72:54:2d:81:a0:ea:c3:ed:f8:20:bf:
         5f:cc:b7:70:00:b7:6e:3b:f6:5e:94:de:e4:20:9f:a6:ef:8b:
         b2:03:e7:a2:b5:16:3c:91:ce:b4:ed:39:02:e7:7c:25:8a:47:
         e6:65:6e:3f:46:f4:d9:f0:ce:94:2b:ee:54:ce:12:bc:8c:27:
         4b:b8:c1:98:2f:a2:af:cd:71:91:4a:08:b7:c8:b8:23:7b:04:
         2d:08:f9:08:57:3e:83:d9:04:33:0a:47:21:78:09:82:27:c3:
         2a:c8:9b:b9:ce:5c:f2:64:c8:c0:be:79:c0:4f:8e:6d:44:0c:
         5e:92:bb:2e:f7:8b:10:e1:e8:1d:44:29:db:59:20:ed:63:b9:
         21:f8:12:26:94:93:57:a0:1d:65:04:c1:0a:22:ae:10:0d:43:
         97:a1:18:1f:7e:e0:e0:86:37:b5:5a:b1:bd:30:bf:87:6e:2b:
         2a:ff:21:4e:1b:05:c3:f5:18:97:f0:5e:ac:c3:a5:b8:6a:f0:
         2e:bc:3b:33:b9:ee:4b:de:cc:fc:e4:af:84:0b:86:3f:c0:55:
         43:36:f6:68:e1:36:17:6a:8e:99:d1:ff:a5:40:a7:34:b7:c0:
         d0:63:39:35:39:75:6e:f2:ba:76:c8:93:02:e9:a9:4b:6c:17:
         ce:0c:02:d9:bd:81:fb:9f:b7:68:d4:06:65:b3:82:3d:77:53:
         f8:8e:79:03:ad:0a:31:07:75:2a:43:d8:55:97:72:c4:29:0e:
         f7:c4:5d:4e:c8:ae:46:84:30:d7:f2:85:5f:18:a1:79:bb:e7:
         5e:70:8b:07:e1:86:93:c3:b9:8f:dc:61:71:25:2a:af:df:ed:
         25:50:52:68:8b:92:dc:e5:d6:b5:e3:da:7d:d0:87:6c:84:21:
         31:ae:82:f5:fb:b9:ab:c8:89:17:3d:e1:4c:e5:38:0e:f6:bd:
         2b:bd:96:81:14:eb:d5:db:3d:20:a7:7e:59:d3:e2:f8:58:f9:
         5b:b8:48:cd:fe:5c:4f:16:29:fe:1e:55:23:af:c8:11:b0:8d:
         ea:7c:93:90:17:2f:fd:ac:a2:09:47:46:3f:f0:e9:b0:b7:ff:
         28:4d:68:32:d6:67:5e:1e:69:a3:93:b8:f5:9d:8b:2f:0b:d2:
         52:43:a6:6f:32:57:65:4d:32:81:df:38:53:85:5d:7e:5d:66:
         29:ea:b8:dd:e4:95:b5:cd:b5:56:12:42:cd:c4:4e:c6:25:38:
         44:50:6d:ec:ce:00:55:18:fe:e9:49:64:d4:4e:ca:97:9c:b4:
         5b:c0:73:a8:ab:b8:47:c2
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            40:01:77:21:37:d4:e9:42:b8:ee:76:aa:3c:64:0a:b7
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: O=Digital Signature Trust Co., CN=DST Root CA X3
        Validity
            Not Before: Jan 20 19:14:03 2021 GMT
            Not After : Sep 30 18:14:03 2024 GMT
        Subject: C=US, O=Internet Security Research Group, CN=ISRG Root X1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Modulus:
                    00:ad:e8:24:73:f4:14:37:f3:9b:9e:2b:57:28:1c:
                    87:be:dc:b7:df:38:90:8c:6e:3c:e6:57:a0:78:f7:
                    75:c2:a2:fe:f5:6a:6e:f6:00:4f:28:db:de:68:86:
                    6c:44:93:b6:b1:63:fd:14:12:6b:bf:1f:d2:ea:31:
                    9b:21:7e:d1:33:3c:ba:48:f5:dd:79:df:b3:b8:ff:
                    12:f1:21:9a:4b:c1:8a:86:71:69:4a:66:66:6c:8f:
                    7e:3c:70:bf:ad:29:22:06:f3:e4:c0:e6:80:ae:e2:
                    4b:8f:b7:99:7e:94:03:9f:d3:47:97:7c:99:48:23:
                    53:e8:38:ae:4f:0a:6f:83:2e:d1:49:57:8c:80:74:
                    b6:da:2f:d0:38:8d:7b:03:70:21:1b:75:f2:30:3c:
                    fa:8f:ae:dd:da:63:ab:eb:16:4f:c2:8e:11:4b:7e:
                    cf:0b:e8:ff:b5:77:2e:f4:b2:7b:4a:e0:4c:12:25:
                    0c:70:8d:03:29:a0:e1:53:24:ec:13:d9:ee:19:bf:
                    10:b3:4a:8c:3f:89:a3:61:51:de:ac:87:07:94:f4:
                    63:71:ec:2e:e2:6f:5b:98:81:e1:89:5c:34:79:6c:
                    76:ef:3b:90:62:79:e6:db:a4:9a:2f:26:c5:d0:10:
                    e1:0e:de:d9:10:8e:16:fb:b7:f7:a8:f7:c7:e5:02:
                    07:98:8f:36:08:95:e7:e2:37:96:0d:36:75:9e:fb:
                    0e:72:b1:1d:9b:bc:03:f9:49:05:d8:81:dd:05:b4:
                    2a:d6:41:e9:ac:01:76:95:0a:0f:d8:df:d5:bd:12:
                    1f:35:2f:28:17:6c:d2:98:c1:a8:09:64:77:6e:47:
                    37:ba:ce:ac:59:5e:68:9d:7f:72:d6:89:c5:06:41:
                    29:3e:59:3e:dd:26:f5:24:c9:11:a7:5a:a3:4c:40:
                    1f:46:a1:99:b5:a7:3a:51:6e:86:3b:9e:7d:72:a7:
                    12:05:78:59:ed:3e:51:78:15:0b:03:8f:8d:d0:2f:
                    05:b2:3e:7b:4a:1c:4b:73:05:12:fc:c6:ea:e0:50:
                    13:7c:43:93:74:b3:ca:74:e7:8e:1f:01:08:d0:30:
                    d4:5b:71:36:b4:07:ba:c1:30:30:5c:48:b7:82:3b:
                    98:a6:7d:60:8a:a2:a3:29:82:cc:ba:bd:83:04:1b:
                    a2:83:03:41:a1:d6:05:f1:1b:c2:b6:f0:a8:7c:86:
                    3b:46:a8:48:2a:88:dc:76:9a:76:bf:1f:6a:a5:3d:
                    19:8f:eb:38:f3:64:de:c8:2b:0d:0a:28:ff:f7:db:
                    e2:15:42:d4:22:d0:27:5d:e1:79:fe:18:e7:70:88:
                    ad:4e:e6:d9:8b:3a:c6:dd:27:51:6e:ff:bc:64:f5:
                    33:43:4f
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            Authority Information Access: 
                CA Issuers - URI:http://apps.identrust.com/roots/dstrootcax3.p7c

            X509v3 Authority Key Identifier: 
                keyid:C4:A7:B1:A4:7B:2C:71:FA:DB:E1:4B:90:75:FF:C4:15:60:85:89:10

            X509v3 Certificate Policies: 
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.44947.1.1.1
                  CPS: http://cps.root-x1.letsencrypt.org

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.identrust.com/DSTROOTCAX3CRL.crl

            X509v3 Subject Key Identifier: 
                79:B4:59:E6:7B:B6:E5:E4:01:73:80:08:88:C8:1A:58:F6:E9:9B:6E
    Signature Algorithm: sha256WithRSAEncryption
         0a:73:00:6c:96:6e:ff:0e:52:d0:ae:dd:8c:e7:5a:06:ad:2f:
         a8:e3:8f:bf:c9:0a:03:15:50:c2:e5:6c:42:bb:6f:9b:f4:b4:
         4f:c2:44:88:08:75:cc:eb:07:9b:14:62:6e:78:de:ec:27:ba:
         39:5c:f5:a2:a1:6e:56:94:70:10:53:b1:bb:e4:af:d0:a2:c3:
         2b:01:d4:96:f4:c5:20:35:33:f9:d8:61:36:e0:71:8d:b4:b8:
         b5:aa:82:45:95:c0:f2:a9:23:28:e7:d6:a1:cb:67:08:da:a0:
         43:2c:aa:1b:93:1f:c9:de:f5:ab:69:5d:13:f5:5b:86:58:22:
         ca:4d:55:e4:70:67:6d:c2:57:c5:46:39:41:cf:8a:58:83:58:
         6d:99:fe:57:e8:36:0e:f0:0e:23:aa:fd:88:97:d0:e3:5c:0e:
         94:49:b5:b5:17:35:d2:2e:bf:4e:85:ef:18:e0:85:92:eb:06:
         3b:6c:29:23:09:60:dc:45:02:4c:12:18:3b:e9:fb:0e:de:dc:
         44:f8:58:98:ae:ea:bd:45:45:a1:88:5d:66:ca:fe:10:e9:6f:
         82:c8:11:42:0d:fb:e9:ec:e3:86:00:de:9d:10:e3:38:fa:a4:
         7d:b1:d8:e8:49:82:84:06:9b:2b:e8:6b:4f:01:0c:38:77:2e:
         f9:dd:e7:39
> Socket encrypted!
> Disconnected
                      1 Reply Last reply
                      0
                      • jeremy_kJ Offline
                        jeremy_kJ Offline
                        jeremy_k
                        wrote on last edited by
                        #12

                        https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/

                        DST Root CA X3 will expire on September 30, 2021. That means those older devices that don’t trust ISRG Root X1 will start getting certificate warnings when visiting sites that use Let’s Encrypt certificates.

                        Qt 5.8 with OpenSSL 1.0 qualifies as an older device in this case.

                        Asking a question about code? http://eel.is/iso-c++/testcase/

                        1 Reply Last reply
                        1
                        • mbruelM Offline
                          mbruelM Offline
                          mbruel
                          wrote on last edited by
                          #13

                          @jeremy_k said in QSslSocket how to dump an expired certificate?:

                          0, 2021. That means those older d

                          hum thanks for the link.

                          What should you do? For most people, nothing at all! We’ve set up our certificate issuance so your web site will do the right thing in most cases, favoring broad compatibility. If you provide an API or have to support IoT devices, you’ll need to make sure of two things: (1) all clients of your API must trust ISRG Root X1 (not just DST Root CA X3), and (2) if clients of your API are using OpenSSL, they must use version 1.1.0 or later. In OpenSSL 1.0.x, a quirk in certificate verification means that even clients that trust ISRG Root X1 will fail when presented with the Android-compatible certificate chain we are recommending by default.

                          I guess it's openssl lib the faulty then!
                          But I don't understand why/how this expired certificate is affecting an app as it is not used anymore in the certificates chain... where/how is this DST Root CA X3 certificate used? is it embedded in openssl?

                          1 Reply Last reply
                          0
                          • jeremy_kJ Offline
                            jeremy_kJ Offline
                            jeremy_k
                            wrote on last edited by
                            #14

                            There was a discussion that went into details on the qt-interest mailing list. https://lists.qt-project.org/pipermail/interest/2021-October/037642.html in particular.

                            Asking a question about code? http://eel.is/iso-c++/testcase/

                            1 Reply Last reply
                            1

                            • Login
                            • Login or register to search.
                            • First post
                              Last post
                            0
                            • Categories
                            • Recent
                            • Tags
                            • Popular
                            • Users
                            • Groups
                            • Search
                            • Get Qt Extensions
                            • Unsolved