New <torproject.org> SSL cert causes freakout.

[tildelowengrimm]

Starting TBL today, I get just a moment of the loading bar, then this:

After clicking to exit, Torbrowser doesn't start.

[saibot8]

I can confirm the bug. I am getting the same error message.

[micah]

The problem appears to be related to Heartbleed, and the Torproject rotating its x.509 certificate for the website. The certificate itself appears to have been re-issued, although I haven't found any statement from the torproject about that re-issue or what the new fingerprints of that certificate should be.

Torbrowser-launcher ships a copy of the certificate, presumably to pin the certificate, and the one that is shipped doesn't validate, because it isn't the one being used anymore. The fix is probably to update that torproject.pem file with the new one, assuming it can be verified properly.

[micahflee]

Ok, I just visited https://www.torproject.org/ in a browser (at a random coffee shop that I happen to be at in Brooklyn), downloaded the cert I see, and replaced it and tested, and it works for me.

This new cert has SHA256 fingerprint:
EA16D6DA769B676BC07A19A0CD21AAF15A9A6693A2C3CD7A87817DB16F5F48F5

And SHA1 fingerprint:
842456568ED7904347AA89AB777DA4943BA1A7D5

Now I'm gonna ask some people who know for sure if this is the right cert over secure channels to confirm before closing this bug.

[saibot8]

I can confirm both (SHA1 & SHA256) fingerprints (accessing from Germany's DFN). (Then again, I am probably not a trustworthy entity, just a random user interested in the awesome software you guys make)

How to get the fingerprints with openssl:
openssl s_client -showcerts -connect torproject.org:443 | openssl x509 -fingerprint -sha1 -noout -in /dev/stdin
openssl s_client -showcerts -connect torproject.org:443 | openssl x509 -fingerprint -sha256 -noout -in /dev/stdin

This yields the following fingerprints (you can remove the colons with | sed 's/://g'):
SHA1: 84:24:56:56:8E:D7:90:43:47:AA:89:AB:77:7D:A4:94:3B:A1:A7:D5
SHA256: EA:16:D6:DA:76:9B:67:6B:C0:7A:19:A0:CD:21:AA:F1:5A:9A:66:93:A2:C3:CD:7A:87:81:7D:B1:6F:5F:48:F5

[grrrrr]

Is there any eta on this? This bug leaves TBB unusable. As there is a new version (3.6) each time you start torbrowser-launcher it fails due to cert errors and the user can not use TBB.

[micahflee]

Sorry about this. I've been crazy busy, but this is quite important. Working on it now.

[micahflee]

I confirmed that 70522ef is the correct cert.

[grrrrr]

@micahflee thank you, will the upbuntu ppa be updated to reflect this change?