[gnutls-devel] GnuTLS | Name Constraints applied to intermediate CA CN because CA certificate does not have Extended key usage (2.5.29.37) (#776)

[Development of GNU's TLS library]

New Issue was created.

Issue 776: https://gitlab.com/gnutls/gnutls/issues/776
Author:    Luiz Angelo Daros de Luca
Assignees: 

## Description of problem:
gnutls rejects intermediate CA when root CA has a name constraint and intermediate CA does not have Extended key usage (2.5.29.37)
pidgin-2.13.0 cannot validate XMPP server certificate and does not connect

## Version of gnutls used:
3.6.7

## Distributor of gnutls (e.g., Ubuntu, Fedora, RHEL)
OpenSUSE Tumbleweed

## How reproducible:

I have an internal PKI infrastructure like this:

Root CA
Intermediate CA
Servers certificates

My Root CA have some name constraints that limit Servers certificate to only domains under our control. We have been using this setup for some years now without issues. However, pidgin always failed to authenticate xmpp certificates.

pidgin has x509_certificate_signed_by to test a certificate validity. It will be called twice:

x509_certificate_signed_by("server_certificate", "Intermediate CA")
x509_certificate_signed_by("Intermediate CA", "Root CA")

In that pidgin function, it calls gnutls_x509_crt_verify (a _gnutls_verify_crt_status wrapper) with the comment "Now, check the signature".

_gnutls_verify_crt_status eventually calls "verify_crt()" with the comment "Verify the last certificate in the certificate path"

One of the tests is:

gnutls_x509_name_constraints_check_crt(vparams->nc, GNUTLS_SAN_DNSNAME, cert);

Which will test name constraints agains DNSNAME (subjetAltName). However, if no subjetAltName was found, it will also test against CN but only "verify the name constraints against the CN, if the certificate is not a CA. We do this check only on certificates marked as WWW server, because that's where the CN check is only performed.".

It checks if it is a "server certificate" and not a CA using _gnutls_check_key_purpose that calls gnutls_x509_crt_get_key_purpose_oid. gnutls_x509_crt_get_key_purpose_oid simply bails out if there is no "2.5.29.37" extension and it assumes that certificate can be used by "any purpose".  Well, my Intermediate CA has these key usage (2.5.29.15): "Certificate Sign, CRL Sign" and Basic Constraint CA:TRUE, but not Extended key usage (2.5.29.37).

My Intermediate CA is considered as a "Web Server". As it normally happens, my Intermediate CA CN will not be a valid DNS name that satisfy Root CA DNS Name constraint. "Intermediate CA" certificate is rejected and also "Server certificate".

Normally a DNS name constraint should not be tested against a CN that does not look like a FQDN.
Also, I might have missed something but it looks like name constraint are tested only against issuer name constraint. However, name constraint should be tested all way down the chain, testing "Server Certificate" names also against Root CA name constraints:

## Actual results:

Client rejects server certificate blaming that "Intermediate CA" certificate is invalid

## Expected results:

As any other SSL lib tested, certificate should be accepted.
Also, gnutls-cli does accept that certificate.

Is pidgin using something that it shouldn't?

-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/issues/776
You're receiving this email because of your account on gitlab.com.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20190528/7dc48de9/attachment-0001.html>