Unknown CA site

Question

Hi,
I have analyzed the comunication from my server to site credemtel and I have one anomaly. In source my server and destination credemtel server I have "Alert (level: Fatal, Description: Unknown CA)". What does this mean? The server does not recognize CA to the site credemtel? What should I do?

Thank you. Best regard

Riccardo

Answer 1

The certificates all look good to me, I suspect that there is an issue on the client machine where it's unable to verify the certificate chain.

I (on Windows) extracted the certificates using tshark and then converted the hex strings to binary with PowerShell and then used certutil to verify:

# Use tshark to extract the certificate bytes
$x = tshark -r pi.cap -Y "frame.number == 201" -T fields -e ssl.handshake.certificate
split the certs at the comma
$c1, $c2, $c3 = $x -split ",+"
Convert strings of "xx:xx…" to bytes in a binary array
$b1 = @( $c1 -split ":+" | foreach-object { [System.Convert]::ToByte($,16) } )
$b2 = @( $c2 -split ":+" | foreach-object { [System.Convert]::ToByte($,16) } )
$b3 = @( $c3 -split ":+" | foreach-object { [System.Convert]::ToByte($_,16) } )
Output the byte arrays to files
$b1 | Set-Content -Encoding Byte -Path cert1.der
$b2 | Set-Content -Encoding Byte -Path cert2.der
$b3 | Set-Content -Encoding Byte -Path cert3.der
Use certutil to verify the cert chain
certutil -verify cert1.der cert2.der
certutil -verify cert2.der cert3.der
Use certutil to very the root CA cert
certutil -verify cert3.der