1

I'm having difficulty using an X.509 certificate to do client authentication from Safari (9.0.1, as on OS X 10.10.5).

The symptom is that I go to a https://... site which does client certificate checking, but Safari appears to simply hang as if it were waiting from a response from the server. In the error console it reports Failed to load resource: cancelled (and on one of the servers I've tried this with, which I have control over, the relevant logs report that the browser appeared to abruptly close the connection – there's no other indication there of a protocol botch).

The certificate is valid and has a good CA signature, as verified by openssl, and by the fact that it works as expected with Firefox, Chrome, and curl. Note that Chrome and OS X curl do use the Keychain, and Firefox doesn't, so there's no common factor there. Also, OS X curl is built against SecureTransport as opposed to OpenSSL, so is, I think, using the same SSL library as Safari (I don't know about Chrome in this respect).

This isn't a server-side problem, because others using the same version of Safari can get to the same URL with certificates from the same CA. Also, I can connect straightforwardly to that site using Chrome, which of course also uses WebKit, and which uses the same certificate, via the Keychain.

The nearest thing to a diagnostic I can find is that a message appears in the Console whenever I do this, saying

2015-11-13 18:43:53.329 Keychain Access[1373]:  SOSCCThisDeviceIsInCircle SOSCCThisDeviceIsInCircle!! 58

(the final number increments each time).

I have been able to find nothing at all relating to that string, apart from passing mentions in a few clearly puzzled forum posts.

I have tried deleting identity preferences from Keychain Access without success, tried deleting similar (expired) certificates from the keychain, and tried exporting deleting and re-importing the relevant certificate; all without effect.

I'm stumped! Does anyone have any suggestions? Since this appears to be a Safari-specific problem, I'm asking here before trying on the security SE.

Improve this question
5
  • 2
    SOSCCThisDeviceIsInCircle is a diagnostic message to handle version change and merge detection on iCloud synced files. You can ignore them or make a new test user so that you're sure you are checking the system keychain and system security and not dealing with user level corruption or trust issues.
    – bmike ♦
    Nov 13, 2015 at 20:00
  • 1
    Just a nitpick: Chrome isn't using WebKit, but rather Blink (which is a fork of it).
    – samh
    Nov 13, 2015 at 20:32
  • @bmike Thanks – that makes sense. Odd that it seemed to be happening correlated with accesses to an unrelated site, but... That can probably be ruled out as significant. Oh well.
    – Norman Gray
    Nov 13, 2015 at 23:55
  • @samh I'd forgotten that – thanks. And I see that Blink appears not to include the SSL layer of the transaction: these are implemented in Chrome, not Blink (if I'm reading the overview correctly). That means that 'it works in Chrome' is probably not significant after all. It's looking more and more like a Safari-specific problem.
    – Norman Gray
    Nov 14, 2015 at 0:04
  • Also, what URL is failing - it might be low security on the sever configuration or a downgrade MITM type scenario...
    – bmike ♦
    Nov 14, 2015 at 0:15

2 Answers 2

Reset to default
1

I like to use the Keychain Access app to troubleshoot cryptographic trust issues and also find making a clean VM of OS X or at least a new user account helps to make sure I know I'm starting from a known trust chain.

  • Open Keychain Access
  • under the Keychain Access menu, select Certificate Assistant and then Evaluate a Certificate

From there you can use the SSL tool to evaluate things and start to pick apart what is failing or succeeding. Bouncing between that tool and Safari usually is worthwhile in sorting errors.

Improve this answer
2
  • Thanks for the suggestion (that looks like a useful tool), but I'm fairly sure from openssl, and from inspection, that the certificate is OK. I'll try using the certificate from another user, though, and see if anything breaks.
    – Norman Gray
    Nov 14, 2015 at 0:08
  • It's usually that the chain of trust safari uses that's the problem. The tool lets you see the provenance and chain more explicitly. Also, you might have to examine the negortiated protocol, Safari is ratcheting up rejecting breakable cipher sizes and protocols. @NormanGray
    – bmike ♦
    Nov 14, 2015 at 0:14
0

Herewith a non-answer:

It appears that this is not a general certificate or trust issue, but a Safari-related bug which, despite some efforts, I've not been able to narrow down beyond that (I'm currently using Safari 9.1.2 on OS X 10.10.5).

The certificate in question fails to work with multiple sites (including the website of its own issuer), but the same certificate works consistently with those sites when used with Chrome (which also uses Keychain Access) or Firefox (which doesn't).

So if you're looking at this because you have the same problem (and I'm adding this answer because Stackexchange has just told me, to my surprise, that this question has now been viewed over 1000 times), then my advice is:

  1. Use a different browser; and
  2. If you can narrow this down any more, then very well done (and thank you), and please consider submitting a bug report about it – the world will then be in your debt.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .