Mojang servers appear to be handing out incorrect SSL certificates
https://bugreports.qt.io/browse/QTBUG-42134 for details.
relevant response from QT devs is:
Richard Moore added a comment - 22/Oct/14 10:42 PM
The server is configured incorrectly. It should be sending leaf and intermediate certificates, but not the root certificate since that needs to be in the trust store. This isn't a bug in Qt.
You can see the problem here:
Certificate chain
0 s:/OU=Domain Control Validated/CN=*.mojang.com
i:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./OU=http://certs.starfieldtech.com/repository//CN=Starfield Secure Certificate Authority - G2
1 s:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./OU=http://certs.starfieldtech.com/repository//CN=Starfield Secure Certificate Authority - G2
i:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./CN=Starfield Root Certificate Authority - G2
2 s:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./CN=Starfield Root Certificate Authority - G2
i:/C=US/O=Starfield Technologies, Inc./OU=Starfield Class 2 Certification Authority
3 s:/C=US/O=Starfield Technologies, Inc./OU=Starfield Class 2 Certification Authority
i:/C=US/O=Starfield Technologies, Inc./OU=Starfield Class 2 Certification Authority
The server should only be sending the first two certificates, not the 3rd which is the root.
Attachments1
NormalCreated Issue:
Mojang servers appear to be handing out incorrect SSL certificates
https://bugreports.qt-project.org/browse/QTBUG-42134 for details.
relevant response from QT devs is:
Richard Moore added a comment - 22/Oct/14 10:42 PM
The server is configured incorrectly. It should be sending leaf and intermediate certificates, but not the root certificate since that needs to be in the trust store. This isn't a bug in Qt.
You can see the problem here:
Certificate chain
0 s:/OU=Domain Control Validated/CN=*.mojang.com
i:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./OU=http://certs.starfieldtech.com/repository//CN=Starfield Secure Certificate Authority - G2
1 s:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./OU=http://certs.starfieldtech.com/repository//CN=Starfield Secure Certificate Authority - G2
i:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./CN=Starfield Root Certificate Authority - G2
2 s:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./CN=Starfield Root Certificate Authority - G2
i:/C=US/O=Starfield Technologies, Inc./OU=Starfield Class 2 Certification Authority
3 s:/C=US/O=Starfield Technologies, Inc./OU=Starfield Class 2 Certification Authority
i:/C=US/O=Starfield Technologies, Inc./OU=Starfield Class 2 Certification Authority
The server should only be sending the first two certificates, not the 3rd which is the root.Environment
logins on Fedora20 using alternative launchers that use QT UI library
MC-73478 → 
WEB-196logins on Fedora20 using alternative launchers that use QT UI library
![[Bot] Arisa](../../../data/assets/gravatar/mustek2.png){kind=small}
![[Mojang] Web Team](../../../data/avatars/users/10122.svg){kind=small}
[Mojang] Web Teamssl_failure_multimc.png
![[Mod] bemoty](../../../data/avatars/users/50554.png){kind=small}
https://bugreports.qt
-project.org/browse/QTBUG-42134 for details.relevant response from QT devs is:
Richard Moore added a comment - 22/Oct/14 10:42 PM
The server is configured incorrectly. It should be sending leaf and intermediate certificates, but not the root certificate since that needs to be in the trust store. This isn't a bug in Qt.
You can see the problem here:
Certificate chain
0 s:/OU=Domain Control Validated/CN=*.mojang.com
i:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./OU=http://certs.starfieldtech.com/repository//CN=Starfield Secure Certificate Authority - G2
1 s:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./OU=http://certs.starfieldtech.com/repository//CN=Starfield Secure Certificate Authority - G2
i:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./CN=Starfield Root Certificate Authority - G2
2 s:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./CN=Starfield Root Certificate Authority - G2
i:/C=US/O=Starfield Technologies, Inc./OU=Starfield Class 2 Certification Authority
3 s:/C=US/O=Starfield Technologies, Inc./OU=Starfield Class 2 Certification Authority
i:/C=US/O=Starfield Technologies, Inc./OU=Starfield Class 2 Certification Authority
The server should only be sending the first two certificates, not the 3rd which is the root.https://bugreports.qt.io/browse/QTBUG-42134 for details.
relevant response from QT devs is:
Richard Moore added a comment - 22/Oct/14 10:42 PM
The server is configured incorrectly. It should be sending leaf and intermediate certificates, but not the root certificate since that needs to be in the trust store. This isn't a bug in Qt.
You can see the problem here:
Certificate chain
0 s:/OU=Domain Control Validated/CN=*.mojang.com
i:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./OU=http://certs.starfieldtech.com/repository//CN=Starfield Secure Certificate Authority - G2
1 s:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./OU=http://certs.starfieldtech.com/repository//CN=Starfield Secure Certificate Authority - G2
i:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./CN=Starfield Root Certificate Authority - G2
2 s:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./CN=Starfield Root Certificate Authority - G2
i:/C=US/O=Starfield Technologies, Inc./OU=Starfield Class 2 Certification Authority
3 s:/C=US/O=Starfield Technologies, Inc./OU=Starfield Class 2 Certification Authority
i:/C=US/O=Starfield Technologies, Inc./OU=Starfield Class 2 Certification Authority
The server should only be sending the first two certificates, not the 3rd which is the root.
![[Mod] Chandler](../../../data/assets/gravatar/triwonder81.png){kind=small}
I just want to clarfiy a little bit.
This problem technically is a bug with the servers, not minecraft itself. And while it may not currently affect the vanilla launcher that you ship to users, this is only due to java's ssl implementation ignoring the incorrect root certificate being given to it by your servers. Technically there is still something to be resolved that is under your control, even if it doesn't prevent your provided launcher from functioning. According to SSL guidelines your server's behavior is actually broken and incorrect.
I propose that under versions you add a Servers tag so we can indicate when a problem is not in a game version of the game code itself, but rather something to do with your servers.
If you still need the root certs to be handed out for some obscure reason that we end-users may not be aware of, at the very least ensure that its handing out the correct SHA256 root cert so SSL implementations that actually verify the certs you hand out won't fail the handshake.
Is this still an issue ?
Side note: https://bugreports.qt-project.org/ has an invalid certificate ...
On the affected machine it is still an issue.
Its strange, my laptop is running the same exact OS, and doesn't have this problem. It is probably interaction from QT and some other package that is messing up the SSL handling, causing it to be stricter than it needs to be, or choosing the wrong certificate to verify.
They refuse to admit fault, and blame the mojang servers. Given what you point out about their own certs, it does seem hypocritical.
Java's SSL implementation is happy on my machine, so I can use the vanilla launcher provided by mojang, but the situation precludes the use of my preferred launcher. (which results in convoluted instance setups when using mods & installing forge and liteloader)
it is a quality of life issue, so its not a high priority issue, but it persists in annoying me nonetheless (and i'm probably not alone, though the circumstances that cause this issue to result in a performance problem aren't common enough for us to represent a large population)
The issue has persisted through upgrades Fedora 21 -> Fedora 22 -> Fedora 23, so whatever is causing it appears to be consistently remaining in place through all of the assorted package upgrades.
I've tried re-installing SSL libraries, ca-cert files, nothing seems to work.
Their certificate expired on Jan 25, 2015, see screenshot.
Well the hypocrisy is delicious, but unfortunately recognizing that doesn't make multimc complete its handshake with the login servers on this machine.
I am amused though.
just to show you what it looks like.
Is this still a problem?