moxie0/sslsniff — Issue #12: Error in parsing SSL certificates with email address
Author: ju916
Created: 2012-01-27 12:13:51+00:00
State: open

If you sprecify an (optional) email address in the certificate request, sslsniff adds it to the CN as part of the hostname. This results in invalid DNS lookups.

Example:

$ openssl req -new -nodes -keyout heise.key -out heise.csr -days 365
Generating a 1024 bit RSA private key
...
Common Name (eg, YOUR name) []:www.heise.de
Email Address []:ju@heise.de
...

$ openssl x509 -in certs/heise.crt -noout -text
...
Subject: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=www.heise.de/emailAddress=ju@heise.de
...
$ sslsniff -t -c ./certs/ -s 1414 -w x1.log
terminate called after throwing an instance of 'boost::exception_detail::clone_impl >'
what(): Host not found (authoritative)
Abgebrochen

tcpdump shows, that sslsniff does a DNS query for "www.heise.de/emailAddress=ju@heise.de.ct.heise.de" which of course does not exist.