Last modified: 2013-03-17 17:06:33 UTC
OpenID consumer when authentication an https://OpenID: show a distinct verification error message in case of untrusted (e.g. self-signed) CA Currently, you see only the general message "Verification error", even when the consumer wiki knows that the CA is untrusted. Inform the user that the verification failed because the OpenID server uses an untrusted (e.g. self-signed) certificate. Additional improvements: + allow to show the server certificate fingerprints (sha-256, sha-1, md5) (must have) + allow to overwrite the single CA error(warning) and accept even an untrusted OpenID on extra user action. (nice to have for testing)
Just for the record: logfile looks like [error] Got no response code when fetching https://provider/phase3/index.php/User:Username, referer: http://consumer/index.php/Spezial:OpenID-Umwandlung [error] CURL error (60): SSL certificate problem, verify that the CA cert is OK. Details:\nerror:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed, referer: http://consumer/index.php/Spezial:OpenID-Umwandlung
*** this is not yet a proposed patch *** see http://www.php.net/manual/de/function.curl-setopt.php for curl options ad-hoc possibility to disable host certificate checks https://gerrit.wikimedia.org/r/#/c/54123/1 : in OpenID.php, or in your LocalSettings.php (after including the extension) add /** * When this wiki is used as consumer: * * Whether OpenID https://provider-host certificates are checked (default) * * true enables SSL Certificate check * this is the default even when the define statement is missing * * set to false if you want to disable SSL Certificate check * this can only by useful for testing with self-signed certificates */ define( 'Auth_OpenID_VERIFY_HOST', true ); In a forthcoming version of the extension this can be part of new settings per-provider.
+ http://unitstep.net/blog/2009/05/05/using-curl-in-php-to-access-https-ssltls-protected-sites/
I analysed the issue and found that it is an "upstream" problem of the php-openid library. The problem is not jeopardizing the security. The distinct verification error message can only be shown, when the underlying php-openid library includes my patch which is sent as https://github.com/openid/php-openid/pull/92 .
