I tried using Auditor, but what is a certificate error?

miyakore

I tried using Auditor while translating, but the result was an error mid-scan. I got a certificate error with results like this: What is this? I translated the text I got from another device, so I'm sorry I can't provide the original

ClickClickDrone

I am not sure I completely understand what you are trying to say, but I'll try to help.

Anyway, have you followed the steps exactly as outlined in the Auditor tutorial?

If so, and you still have issues, then we need more detailed information to be able to troubleshoot, such as the exact error that is popping up and whether it is on the device that is auditing or being audited.

miyakore

There are some sentences that I've left out a bit

Error encountered verifying attestation:

Root cert Certificate:
Data:
Version: 3 (0x2)
Serial Number
Signature Algorithm:
Issuer: serialNumber
Validity

Not Before: May 26 16:28:52 2016 GMT
Not After : May 24 16:28:52 2026 GMT
Subject:
Subject Public Key Info:
Public Key Algorithm
Public-Key: (4096 bit)
Modulus:

Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:

        X509v3 Authority Key Identifier:

v3 Subject Key Identifier:

        X509v3 Authority Key Identifier:
            keyid:

        X509v3 Basic Constraints: critical
            CA:TRUE
        X509v3 Key Usage: critical
            Digital Signature, Certificate Sign, CRL Sign
        X509v3 CRL Distribution Points:

            Full Name:

is not correctly self-signed

I'm sorry that the part that corresponds to personal information has been deleted, making it difficult to understand

de0u

miyakore Apparently some certificate expired May 24, but based on the information provided we don't know which one. Is it possible that the auditor device is an old device that is missing updates or is EOL?

miyakore

de0u Thank you, it's possible that the update on the Auditor's phone is a little late. I'll try it here again for a bit. Thank you both

miyakore

I updated my computer on the auditor side and checked again, but the result was that the OME lock was off. I followed the proper instructions when downloading and putting in GOS, but now even in developer mode, the OME lock remains unlocked and locked. There's something scary about it,
Is there a possibility of a takeover?

de0u

miyakore OEM unlocking being enabled is not by itself a known compromise. If the firmware and OS are fine, disabling OEM unlocking should result in a clean audit.

GrapheneOS

miyakore de0u Auditor version 92 is required for verification of 6th generation Pixels. It was released on May 30th. It sounds like they've disabled OS and app updates so they're on an old version of Auditor and are getting an error from an issue which was already solved. It should be on version 92 on both ends, although it's only required on the Auditor end rather than the Auditee end for this specific issue. If they weren't already paired previously then they'll need to clear pairings on one end and repeat the process.

de0u

GrapheneOS Oh, I see. Arguably Google made a mistake in 2021 when they shipped the 6 with a certificate that was generated in 2016 and expired in 2026, though I guess it's an understandable oversight since the 6 series was the first with more than three years of projected support. And I can imagine that they might not be super-energized right now about spending effort to update attestation on 6-series devices given the short remaining support lifetime and the absence of threat due to the certificate expiration.

miyakore

There are various issues, such as the support period for the certificate on the device itself. I learned a lot. Thank you all.

GrapheneOS

miyakore 7th gen and later Pixels support rotating the keys and do it regularly for each app but 6th gen Pixels only ever had part of what's required shipped and don't do it. It's likely it could have been retrofitted onto them but they didn't fully do it so they ended up in this situation. Their plan was likely to have 6th gen Pixels rotate keys but it didn't end up happening so we had to work around it.