Re: Google using Expired Cert and SSLv2

[Ivaylo Kostadinov <ivaylo.kostadinov@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>]

It seems you caught them just before they updated it.

Now it is v3 and valid from yesterday:

---
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4063034 (0x3dff3a)
        Signature Algorithm: md5WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting 
cc, OU=Certification Services Division, CN=Thawte Server 
CA/emailAddress=server-certs@xxxxxxxxxx
        Validity
            Not Before: Mar 31 20:09:01 2004 GMT
            Not After : Mar 31 18:52:39 2005 GMT
        Subject: C=US, ST=California, L=Mountain View, O=Google Inc, 
CN=www.google.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (1024 bit)
                Modulus (1024 bit):
                    00:ce:88:dc:7e:9a:fa:8b:5d:24:7d:f1:4a:ea:fb:
                    a8:4a:33:9d:9c:ef:22:c9:4d:2f:ac:a0:d3:86:05:
                    4f:d1:bb:cb:26:a6:f4:93:b4:43:aa:a9:28:b7:71:
                    cf:a4:47:f1:c3:20:41:2d:d4:8a:1c:20:bd:6f:8a:
                    f0:9d:a4:ea:70:65:5d:10:e3:ea:7d:d2:b9:87:f4:
                    1e:71:60:23:75:60:49:0d:4c:c0:0e:d9:91:d2:3f:
                    49:74:3f:6c:bf:a1:56:46:1f:99:e6:16:33:02:4e:
                    06:b6:54:81:58:de:7e:2e:69:1b:f4:76:85:40:46:
                    b3:fe:19:33:26:8c:fb:89:ad
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client 
Authentication, Netscape Server Gated Crypto
            X509v3 CRL Distribution Points:
                URI:http://crl.thawte.com/ThawteServerCA.crl

            Authority Information Access:
                OCSP - URI:http://ocsp.thawte.com

            X509v3 Basic Constraints: critical
                CA:FALSE
    Signature Algorithm: md5WithRSAEncryption
        34:eb:5f:20:b9:ec:d0:4f:8c:61:b8:37:9b:cc:3f:f4:6a:e8:
        39:c9:f9:43:22:13:63:91:6e:ab:52:21:2c:8a:26:33:a3:bc:
        02:dc:c3:85:21:04:8d:61:1f:f3:0e:13:cc:f4:92:a5:fa:cc:
        37:53:e5:a2:41:88:f1:40:ea:92:0d:3e:21:63:16:6d:a6:5a:
        bc:c2:db:4c:69:ad:c2:a6:6a:26:00:04:9d:5b:9a:12:6f:51:
        b0:b7:df:e6:5e:32:0b:bc:bb:26:02:b8:e9:85:d5:e6:f9:be:
        7c:5a:88:4e:2e:ff:a2:7d:7c:1f:c1:f8:c8:92:d4:34:21:2c:
        71:05
-----BEGIN CERTIFICATE-----
MIIDUDCCArmgAwIBAgIDPf86MA0GCSqGSIb3DQEBBAUAMIHEMQswCQYDVQQGEwJa
QTEVMBMGA1UECBMMV2VzdGVybiBDYXBlMRIwEAYDVQQHEwlDYXBlIFRvd24xHTAb
BgNVBAoTFFRoYXd0ZSBDb25zdWx0aW5nIGNjMSgwJgYDVQQLEx9DZXJ0aWZpY2F0
aW9uIFNlcnZpY2VzIERpdmlzaW9uMRkwFwYDVQQDExBUaGF3dGUgU2VydmVyIENB
MSYwJAYJKoZIhvcNAQkBFhdzZXJ2ZXItY2VydHNAdGhhd3RlLmNvbTAeFw0wNDAz
MzEyMDA5MDFaFw0wNTAzMzExODUyMzlaMGgxCzAJBgNVBAYTAlVTMRMwEQYDVQQI
EwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRMwEQYDVQQKEwpH
b29nbGUgSW5jMRcwFQYDVQQDEw53d3cuZ29vZ2xlLmNvbTCBnzANBgkqhkiG9w0B
AQEFAAOBjQAwgYkCgYEAzojcfpr6i10kffFK6vuoSjOdnO8iyU0vrKDThgVP0bvL
Jqb0k7RDqqkot3HPpEfxwyBBLdSKHCC9b4rwnaTqcGVdEOPqfdK5h/QecWAjdWBJ
DUzADtmR0j9JdD9sv6FWRh+Z5hYzAk4GtlSBWN5+Lmkb9HaFQEaz/hkzJoz7ia0C
AwEAAaOBqjCBpzAoBgNVHSUEITAfBggrBgEFBQcDAQYIKwYBBQUHAwIGCWCGSAGG
+EIEATA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnRoYXd0ZS5jb20vVGhh
d3RlU2VydmVyQ0EuY3JsMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAYYWaHR0
cDovL29jc3AudGhhd3RlLmNvbTAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBBAUA
A4GBADTrXyC57NBPjGG4N5vMP/Rq6DnJ+UMiE2ORbqtSISyKJjOjvALcw4UhBI1h
H/MOE8z0kqX6zDdT5aJBiPFA6pINPiFjFm2mWrzC20xprcKmaiYABJ1bmhJvUbC3
3+ZeMgu8uyYCuOmF1eb5vnxaiE4u/6J9fB/B+MiS1DQhLHEF
-----END CERTIFICATE-----

---



ivaylo











Matthew S. Hamrick wrote:
> http://www.cryptonomicon.net/modules.php?name=News&file=article&sid=729
>
> Don't know how apropos it is to bugtraq, but I suppose it's relevant to the web
> application security community. It's fairly well known amongst people who use
> SSL to secure portions of their web application that SSL version 2 is "bad."
> It's so bad that a bunch of really smart people went out and created SSL version
> 3. So I was pretty surprised today when I noticed that https://www.google.com/
> is using an expired certificate and SSLv2.
>
> Guess the moral of the story is: "even the big guys can get it wrong."
>
> /etc
> Matt H.

--


=============================
Ivaylo Kostadinov
GRID Systems Manager
Oxford e-Science Centre
Oxford University
13 Banbury Road
Oxford OX2 6NN

Phone:  +44 1865 273289
Fax:    +44 1865 273275
=============================