ssl incorrect certificate order causes error

[liamwhite]

Describe the bug
Wix websites present an incorrectly ordered certificate chain which the ssl module cannot verify - however this issue is not present in any web browsers, or openssl s_client as they can verify the certificate just fine.

To Reproduce

1> ssl:start(), ssl:connect("images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com", 443, [{verify, verify_peer},
       {cacerts, public_key:cacerts_get()}]).
=NOTICE REPORT==== 20-Jun-2024::12:34:45.816504 ===
TLS client: In state wait_cert_cr at ssl_handshake.erl:2162 generated CLIENT ALERT: Fatal - Bad Certificate

{error,{tls_alert,{bad_certificate,"TLS client: In state wait_cert_cr at ssl_handshake.erl:2162 generated CLIENT ALERT: Fatal - Bad Certificate\n"}}}

Expected behavior
The connection should be successful

openssl s_client images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com:443 retuns:

depth=2 C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority
verify return:1
depth=1 C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Domain Validation Secure Server CA
verify return:1
depth=0 CN = *.wixmp.com
verify return:1
...
Verify return code: 0 (ok)

Affected versions
OTP 27

[IngelaAndin]

The reason is that you need to configure sha1 to be an allowed signature algorithm for certs. See discussion in #8588
In this example I included the best way of doing it.

ssl:connect("images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com", 443,  [{customize_hostname_check, [{match_fun, public_key:pkix_verify_hostname_match_fun(https)}]}, {signature_algs_cert, ssl:signature_algs(default, 'tlsv1.3') ++ [{sha, rsa}]}, {cacerts, public_key:cacerts_get()}]).
{ok,{sslsocket,{gen_tcp,#Port<0.10>,tls_connection,
                        undefined},
               [<0.154.0>,<0.153.0>]}}

[IngelaAndin]

Note that you also need to customize the hostname check for this site, which you will discover once you allow {sha, rsa} or
it will work equally well using rsa_pkcs1_sha1 which is the TLS-1.3 name for this legacy algorithm only allowed for certificate signatures in TLS-1.3.

[liamwhite]

Duplicate of #8588 - closing