Re:Cloudflare, Mozilla, Fastly, and Apple Working on Encrypt...
by tialaramex on Monday July 16, 2018 @12:56PM
(#17542806)
Examples of things we're sure are safe to insist on for certificates in the public Internet but we can't check in people's crappy corporate networks because the checks would just constantly fail and nobody cares to fix anything:
* The FQDN (minus a trailing dot) of the site must appear either exactly as a SAN dnsName or, with its first label replaced by a single asterisk, as a "wildcard", in the certificate, otherwise the cert is worthless
* The cert should have an Extended Key Usage. The EKU must contain at least 1.3.6.1.5.5.7.3.1 (meaning this key is to be used to identify a TLS server)
* The certificate mustn't use SHA-1 (or MD5 for that matter) as part of a signature algorithm
* The FQDN (minus a trailing dot) of the site must appear either exactly as a SAN dnsName or, with its first label replaced by a single asterisk, as a "wildcard", in the certificate, otherwise the cert is worthless
* The cert should have an Extended Key Usage. The EKU must contain at least 1.3.6.1.5.5.7.3.1 (meaning this key is to be used to identify a TLS server)
* The certificate mustn't use SHA-1 (or MD5 for that matter) as part of a signature algorithm