[Bug 17783] New: steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

Summary: steamcommunity.com certificate not recognised
           Product: Wine
           Version: 1.1.17
          Platform: Other
               URL: https://steamcommunity.com
        OS/Version: other
            Status: UNCONFIRMED
          Severity: minor
          Priority: P2
         Component: mshtml
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

Trying to use the community tab in Steam gives an error dialog
"steamcommunity.com uses an invalid security certificate. The certificate is
not trusted because the issuer is unknown. (Error code:
sec_error_unknown_issuer)"

I think steamcommunity.com recently got a EV SSL certificate, so the problem is
probably that nssckbi.dll in wine_gecko needs to be updated.

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

Maxim Borkunov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #1 from Maxim Borkunov   2009-03-20 23:42:54 ---
Same problem.

wine 1.1.17

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

Jeff Zaroyko  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|0                           |1

--- Comment #2 from Jeff Zaroyko   2009-03-21 07:21:32 ---
confirming

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

Kari  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #3 from Kari   2009-03-25 06:06:55 ---
Same problem here too.

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

Jan Kalab  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #4 from Jan Kalab   2009-03-31 01:20:21 ---
Confirming this problem in 1.1.18

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

--- Comment #5 from Matteo Hausner   2009-03-31 10:47:21 ---
Yup confirming too

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

Luke Bratch  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

Vitaliy Margolen  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |17283

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

Evil  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #6 from Evil   2009-04-11 10:16:50 ---
Problem still exist in 1.1.19

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

Paul "TBBle" Hampson  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #7 from Paul "TBBle" Hampson   2009-04-18 10:50:42 ---
I can't confirm this right now, as I can't find my records from the time, but a
month or two ago Steam's certificates were incorrectly set up, and the
described error dialog was happening on Windows Internet Explorer 6 and Firefox
3 as well.

Basically, Steam's servers were not providing the full certificate chain from
their certificate to a trusted root certificate, so their certificate was being
rejected.

I'm fairly sure it's just a matter of installing the two certificates on
http://www.verisign.com/support/verisign-intermediate-ca/extended-validation...
into whatever wine-gecko is using as a certificate store. One of them is signed
by an existing trusted Verisign root certificate, the other is signed by the
former, and the Steam certificate is signed by the latter, completing the chain
of trust.

I suspect Steam's support only tested their new certificates with IE7, which
probably has the Verisign EV SGC certificates pre-installed.

If I'm wrong about the above URLs, the correct intermediate certificates were
found at the time by googling for the name of the signing certificate of the
Steam certificate that is failing.

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

--- Comment #8 from Paul "TBBle" Hampson   2009-04-18 10:53:47 ---
For reference, here are some threads from the Steam forums mentioning this
problem. It seems the mods there don't realise that this is a
server-configuration problem, and believe these users have distrusted
Verisign...

http://forums.steampowered.com/forums/showthread.php?t=827011&highlight=...
http://forums.steampowered.com/forums/showthread.php?t=822050&highlight=...

As such, I'm not sure this is a Wine bug per. se, although I don't know if
there's actually a method to add certificates to wine-gecko's certificate
store.

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

--- Comment #9 from Paul "TBBle" Hampson   2009-04-18 11:17:10 ---
I've just confirmed (using openssl s_client -connect steamcommunity.com:443
-showcerts) that steamcommunity.com is not including the necessary intermediate
certificates, so this is not a Wine problem per se.

I've confirmed that the link I gave before is the correct pair of certificates
for users to install to get this fixed on their end. The second one (Secondary
EV SSL Intermediate CA Certificate) is the issuer of the steamcommunity.com
certificate, and the first one (Primary EV SSL Intermediate CA Certificate) is
the issuer of the second one. The first one is signed by "C=US, O=VeriSign,
Inc., OU=Class 3 Public Primary Certification Authority" which should already
be in your trusted certificates list.

I can't post on the Staem forums or the Steam support system (no idea why) so
if someone wants to report this to them via either method, that'd be great.

Their server admins should install the bundle at
http://www.verisign.com/support/verisign-intermediate-ca/extended-validation...
which is the above two certificates combined into one file for use on an Apache
server.

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

--- Comment #10 from James Andrewartha   2009-04-18 11:48:23 ---
It's odd then that the SSL cert is accepted by native Windows and Linux Firefox
3, but when I grab the nssckbi.dll from the Firefox 3 zip at
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-mozilla1.9.0/ and
put it in my wine_gecko directory, Steam still gives the
sec_error_unknown_issuer error. Actually, running wine on that Firefox gives
the error as well, so it's not a nssckbi.dll problem at all.

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

--- Comment #11 from Austin English   2009-04-18 15:17:28 ---
(In reply to comment #7)
> I'm fairly sure it's just a matter of installing the two certificates on
> http://www.verisign.com/support/verisign-intermediate-ca/extended-validation...
> into whatever wine-gecko is using as a certificate store. One of them is signed
> by an existing trusted Verisign root certificate, the other is signed by the
> former, and the Steam certificate is signed by the latter, completing the chain
> of trust.

I believe crypt32 handles that, which checks your native keychain store. See
CRYPT_knownLocations in crypt32/rootstore.c

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

Justin H Haynes  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #12 from Justin H Haynes   2009-04-18 15:33:51 ---
I updated steam forum with information from this thread:
http://forums.steampowered.com/forums/showthread.php?p=9667249#post9667249

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

--- Comment #13 from Justin H Haynes   2009-04-18 15:52:22 ---
(In reply to comment #11)
> (In reply to comment #7)
> > I'm fairly sure it's just a matter of installing the two certificates on
> > http://www.verisign.com/support/verisign-intermediate-ca/extended-validation...
> > into whatever wine-gecko is using as a certificate store. One of them is signed
> > by an existing trusted Verisign root certificate, the other is signed by the
> > former, and the Steam certificate is signed by the latter, completing the chain
> > of trust.
>
> I believe crypt32 handles that, which checks your native keychain store. See
> CRYPT_knownLocations in crypt32/rootstore.c

So I find:

static const char * const CRYPT_knownLocations[] = {
 "/etc/ssl/certs/ca-certificates.crt",
 "/etc/ssl/certs",
 "/etc/pki/tls/certs/ca-bundle.crt",
 "/usr/local/share/certs/",
};

Would the certificates need to be present at compile time or runtime?

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

--- Comment #14 from Paul "TBBle" Hampson   2009-04-18 16:24:39 ---
Does wine-gecko hand off to crypt32? It includes the NSS libraries so I assumed
it used those, in which case the default certificates are in nssckbi.dll as
mentioned earlier. (I doubt newer versions of that DLL contain intermediate
CAs, though I could be wrong, so simply dropping in a newer one may not help)

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

--- Comment #15 from Paul "TBBle" Hampson   2009-04-18 16:27:30 ---
Just read the Steam forums posting. I should clarify that this problem also
occurs on a fresh version of IE6, one that has never visited another site using
these same intermediate CAs. (Which is where I first noticed this problem,
inside the steam client itself under Windows XP)

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

--- Comment #16 from Austin English   2009-04-18 17:15:11 ---
(In reply to comment #13)
> (In reply to comment #11)
> > (In reply to comment #7)
> > > I'm fairly sure it's just a matter of installing the two certificates on
> > > http://www.verisign.com/support/verisign-intermediate-ca/extended-validation...
> > > into whatever wine-gecko is using as a certificate store. One of them is signed
> > > by an existing trusted Verisign root certificate, the other is signed by the
> > > former, and the Steam certificate is signed by the latter, completing the chain
> > > of trust.
> >
> > I believe crypt32 handles that, which checks your native keychain store. See
> > CRYPT_knownLocations in crypt32/rootstore.c
>
> So I find:
>
> static const char * const CRYPT_knownLocations[] = {
>  "/etc/ssl/certs/ca-certificates.crt",
>  "/etc/ssl/certs",
>  "/etc/pki/tls/certs/ca-bundle.crt",
>  "/usr/local/share/certs/",
> };
>
> Would the certificates need to be present at compile time or runtime?

Runtime.

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

--- Comment #17 from James Andrewartha   2009-04-18 22:30:47 ---
I ran Steam and Firefox with WINEDEBUG=+crypt and there was nothing about it
trying to load certificates. Firefox did work OK with
https://www.britishairways.com/ which has a VeriSign EV cert, but s_client
shows a full chain being sent.

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

--- Comment #18 from Evil   2009-04-26 09:12:43 ---
I knew this issue prevented me from seeing the community page, but didn't
notice that it would also stop you from purchasing new software until I tried
to buy the Orange Box today.

I worked around it by accessing the site from a web-browser, but sent a Support
request asking to have the server-side issue fixed - since it can be an
annoyance to Windows users as well.

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

Matthew Hatch  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #19 from Matthew Hatch   2009-05-05 11:35:48 ---
So is it impossible to import these certificates into wine-gecko?  Running the
latest wine-snapshot rpm available for openSUSE (1.1.20.20090504-1.1) I'm still
getting the ssl error.

Bah.

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

--- Comment #20 from James Andrewartha   2009-05-05 11:41:41 ---
(In reply to comment #19)
> So is it impossible to import these certificates into wine-gecko?  Running the
> latest wine-snapshot rpm available for openSUSE (1.1.20.20090504-1.1) I'm still
> getting the ssl error.

You could import them manually into the profile certificate store, which is
located in ~/.wine/drive_c/windows/profiles/<username>/Application
Data/Mozilla/Profiles/MSHTML/<random characters>/ using
http://www.mozilla.org/projects/security/pki/nss/tools/certutil.html

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

--- Comment #21 from Justin H Haynes   2009-05-05 19:38:35 ---
> You could import them manually into the profile certificate store, which is
> located in ~/.wine/drive_c/windows/profiles/<username>/Application
> Data/Mozilla/Profiles/MSHTML/<random characters>/ using
> http://www.mozilla.org/projects/security/pki/nss/tools/certutil.html

I notice that even after running "wine iexplore" and browsing around in the
toolbar-less wine-gecko based IE-like browser, that I stiill don't have a
~/.wine/drive_c/windows/profiles/<username>/Application
 Data/Mozilla/Profiles/MSHTML/<random characters>/ directory.  Also I don't
find a cert8.db or key3.db file aside from those in my firefox and thunderbird
dirs under my ~/.  And the certutil must be built I suppose.

So my questions are:

1) How can I generate the key and cert database in the correct place without a
profile, or
2) how do I get wine-gecko to make these directories you speak of?

Thanks,

Justin

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

--- Comment #22 from James Andrewartha   2009-05-05 21:18:20 ---
(In reply to comment #21)
> I notice that even after running "wine iexplore" and browsing around in the
> toolbar-less wine-gecko based IE-like browser, that I stiill don't have a
> ~/.wine/drive_c/windows/profiles/<username>/Application
>  Data/Mozilla/Profiles/MSHTML/<random characters>/ directory.  Also I don't
> find a cert8.db or key3.db file aside from those in my firefox and thunderbird
> dirs under my ~/.  And the certutil must be built I suppose.

certutil is available in libnss3-tools in Debian/Ubuntu.
> So my questions are:
> - How can I generate the key and cert database in the correct place without a
>
> profile, or
> 2) how do I get wine-gecko to make these directories you speak of?

1) you need a profile 2) I'm not sure why you don't have a profile at all.
Looking at the timestamps on my profile directory, it's possible wine_gecko
0.9.0 and 0.9.1 don't create a profile, in which case my instructions aren't
useful. I can't see a profile directory using lsof either.

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

Casey Jones  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #23 from Casey Jones   2009-05-10 18:09:16 ---
Found a workaround.  You can go to the Steam Friend's list and right click a
friend and hit "View SteamID page" and it takes you to their page.

I believe the certificate problem is occurring because the home page of Steam
Community is the control panel for your Account.  When you go to other user's
pages, it doesn't think you're logged in.  You show up as logged in on their
friend's list, but on the comments section it says you need to log in, and you
don't have links to view your profile, or to view your control panel.

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

Rodrigo Saboya  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

Adys  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |adys.wh+winehqdotorg@gmail.
                   |                            |com

--- Comment #24 from Adys   2009-06-07 21:59:38 ---
Okay so this is not a wine bug at all; the same happens under Chrome for what
it's worth. An enhancement would be to be able to view the page anyway, instead
of that awkward popup we get right now.

This could use a rename.

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

[e-mail] changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

Dmitry Timoshkov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #25 from Dmitry Timoshkov   2009-06-20 07:57:48 ---
*** Bug 18998 has been marked as a duplicate of this bug. ***

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

Casey Jones  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #26 from Casey Jones   2009-08-12 00:02:04 ---
This bug appears to be fixed.  I can now sign in to the steam community page
from steam.

Can anyone else confirm this?
I'm still on wine-1.1.26

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

Jacek Caban  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #27 from Jacek Caban   2009-08-24 11:09:32 ---
Fixed both in Wine and by Valve.

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

Jacek Caban  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #28 from Jacek Caban   2009-08-24 11:11:26 ---
Fixed.

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

--- Comment #29 from Nikolay Engyozov   2009-08-24 15:27:30 ---
I still have the same problem and message - wine version 1.1.27

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

--- Comment #30 from Vitaliy Margolen   2009-08-24 23:01:58 ---
(In reply to comment #29)
> I still have the same problem and message - wine version 1.1.27

Works fine in wine-1.1.28, upgrade.

[Bug 17783] steamcommunity.com certificate not recognised

http://bugs.winehq.org/show_bug.cgi?id=17783

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #31 from Alexandre Julliard   2009-09-02 14:23:57 ---
Closing bugs fixed in 1.1.29.