[gnutls-devel] SSL certificate validation bugs in GnuTLS
Antoine Delignat-Lavaud
antoine at delignat-lavaud.fr
Tue Feb 18 00:46:41 CET 2014
Le 17/02/2014 13:51, Nikos Mavrogiannopoulos a écrit :
> On Thu, Feb 13, 2014 at 8:14 PM, Nikos Mavrogiannopoulos
> <nmav at gnutls.org> wrote:
>
>>>>> 4. enforce name constraints
>> That would be nice to be enabled by default anyway. I have had hard time
>> to find a CA that uses that though. Anyway I'm working on an API to get
>> and set this extension's data so you could use that (not committed yet).
>
> I've implemented this functionality in master, but not added it in the
> verification process.
> The only certificate in my trusted root which contained this extension had:
> 1. Marked it as non-critical (RFC5280 requires this is critical)
> 2. DNSNames listed in the wrong format (e.g., '.com' instead of 'com').
>
> So I'm still not sure whether this is something that should be checked
> by default.
The CA/B forum has made an exception to allow the use of a non-critical
name constraints extension because of poor implementation support in TLS
libraries. This is also one of the reasons why CAs are reluctant to
enable name constraints - thus if you are waiting for this feature to be
widely used before implementing it, it will never see the light of day.
Also, you'll find attached a list of CA certificates found in the wild
that use name constraints.
Best,
ADL
-------------- next part --------------
+---------+-----------------------------------------------------------------------------------------------------------------------------------+
| certID | subject |
+---------+-----------------------------------------------------------------------------------------------------------------------------------+
| 263959 | CN=TEST RSA Signing CA1,OU=DEMO Certification Services,O=Carillon Information Security Inc.,C=CA |
| 327706 | CN=Vonage Intermediate Corporate Server CA,OU=Vonage Networks,O=Vonage Holdings,C=US |
| 327707 | CN=Vonage Intermediate Corporate Server CA,OU=Vonage Networks,O=Vonage Holdings,C=US |
| 622705 | CN=Ashrpca001,OU=dpki,OU=r,O=mil,C=gb |
| 663004 | CN=OpsCA,OU=PKI,OU=Ops,O=Red Condor |
| 691866 | CN=SBGroup,DC=sbgroup,DC=sbstahl,DC=local |
| 1254714 | CN=VeriSign Client External Certification Authority,OU=Certification Authorities,OU=ECA,O=U.S. Government,C=US |
| 1295139 | CN=Omniscient Technologies Servers CA,OU=Omniscient Networks,O=Omniscient Technologies,C=US |
| 1295140 | CN=Omniscient Technologies Core Server CA,OU=Omniscient Networks,O=Omniscient Technologies,C=US |
| 1396482 | CN=U.S. Department of State AD High Assurance CA,CN=AIA,CN=Public Key Services,CN=Services,CN=Configuration,DC=state,DC=sbu |
| 1581282 | CN=Multi Resolution Image Technology Certificate Authority,OU=Certificate Authority,O=Multi Resolution Image Technology,C=DE |
| 2363493 | CN=DoD Interoperability Root CA 1,OU=PKI,OU=DoD,O=U.S. Government,C=US |
| 2669148 | O=abox.el1t3.org,CN=ca |
| 3348480 | CN=ORC ECA ITDev,OU=Certification Authorities,OU=ECA,O=U.S. Government,C=US |
| 3494127 | CN=NPKIRootCA,O=NATO |
| 3543819 | CN=Touring Club Suisse CA,O=Touring Club Suisse (TCS),L=Vernier,ST=Geneva,DC=tcsgroup,DC=ch,C=CH |
| 3825106 | CN=Banka Slovenije CA Ent Sub,DC=bsi,DC=si |
| 3888882 | CN=Banka Slovenije CA SA Sub,DC=bsi,DC=si |
| 4877034 | CN=ICC-CPI Advanced G3 CA1,O=ICC-CPI,DC=ICC,DC=INT |
| 4900138 | CN=ICC-CPI Advanced G2 CA1,O=ICC-CPI,DC=ICC,DC=INT |
| 5017095 | CN=Ibridge Issuing CA01 |
| 5022889 | CN=Ibridge Issuing CA01 |
| 5303361 | E=asu at tyumbit.ru,CN=Asu-SubCA,O=Tyumbit-Asu,L=Tyumen,C=RU |
| 5348564 | CN=Server Management,Description=Certificate Management,OU=Security & Identity Management,O=Cyssea,L=Paris,C=FR |
| 5626019 | CN=DoD Interoperability Root CA 1,OU=PKI,OU=DoD,O=U.S. Government,C=US |
| 5926615 | E=rd-adm at suse.de,CN=SUSE CA suse.de,OU=OPS Services,O=SUSE Linux Products GmbH,L=Nuremberg,ST=Franconia,C=DE |
| 6199468 | C=US,ST=Michigan,L=Ann Arbor,O=Gizmo Labs Inc.,CN=Gizmo Labs Certificate Authority II |
| 6291126 | CN=AppNexus Intermediate Server CA |
| 6291127 | CN=AppNexus Root CA |
| 6582872 | E=sysadmin at htl-leonding.ac.at,CN=HTL-Leonding internal servers CA,OU=EDVO,O=HTL-Leonding,ST=Upper Austria,C=AT |
| 7310367 | CN=Technological Educational Institution of Thessaloniki CA R2,O=Hellenic Academic and Research Institutions Cert. Authority,C=GR |
| 7310377 | CN=Hellenic Academic and Research Institutions RootCA 2011,O=Hellenic Academic and Research Institutions Cert. Authority,C=GR |
| 7383682 | CN=U.S. Department of State AD Root CA,CN=AIA,CN=Public Key Services,CN=Services,CN=Configuration,DC=state,DC=sbu |
| 7584472 | CN=AppNexus Intermediate Server CA |
| 7761913 | CN=ATT Wi-Fi Services Root Certificate Authority G2,OU=ATT Wi-Fi Services,O=ATT Services Inc,ST=Texas,C=US |
| 7763739 | CN=Intel External Basic Policy CA,O=Intel Corporation,C=US |
| 8232412 | CN=DST ACES CA X6,OU=DST ACES,O=Digital Signature Trust,C=US |
+---------+-----------------------------------------------------------------------------------------------------------------------------------+
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4270 bytes
Desc: Signature cryptographique S/MIME
URL: </pipermail/attachments/20140218/fb299a9a/attachment-0001.bin>
More information about the Gnutls-devel
mailing list