News for hackers. Stuff that matters.

A comment on Chromium and Mozilla to enforce 1 year validity for TLS certificates. Parent comment

Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by xg15 on Sunday June 28, 2020 @12:25PM (#23669872)
I admit, that's a solution, even if a very unpleasant one: Installing a custom root CA is intentionally complicated, so this is hardly doable as an onboarding experience. The setup must be repreated for every single client device that should access the server.

There remains the question how I would get the CA certificate onto client devices in the first place.

Lastly, with asking consumers to install a CA certificate, I ask for a significantly more powerful permission than if I could just have them trust my certificate. This seems like a step backwards security-wise.

[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by est31 on Sunday June 28, 2020 @12:32PM (#23669936)
> Lastly, with asking consumers to install a CA certificate, I ask for a significantly more powerful permission than if I could just have them trust my certificate.

CA certificates can be constrained. https://tools.ietf.org/html/rfc5280#section-4.2.1.10

[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by toast0 on Sunday June 28, 2020 @01:29PM (#23670411)
Are common certificate validation libraries honoring these constraints?

When I tried to use this many moons ago, most things ignored the constraints; although I could mark the extension critical, and then some (but not all, yay) of the things that didn't understand would refuse the CA.

[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by est31 on Sunday June 28, 2020 @03:09PM (#23671224)
IDK NSS seems to have code to verify it:

https://searchfox.org/mozilla-central/source/security/nss/li...

As does webpki:

https://github.com/briansmith/webpki/blob/482627c40dad2148da...

But haven't tested it (or checked other libraries).

[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by est31 on Monday June 29, 2020 @07:29PM (#23684686)
Update: tested it with openssl and webpki. both claim to have support but it only works with openssl. For webpki I had to file two bugs:

https://github.com/briansmith/webpki/issues/134

https://github.com/briansmith/webpki/issues/135

[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by namibj on Sunday June 28, 2020 @01:36PM (#23670466)
Can you name and shame those that ignored the critical extension? Sounds CVE-worthy. A date to guess the versions you used would also help.
[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by toast0 on Sunday June 28, 2020 @02:31PM (#23670943)
No, it was on the order of 5 years ago; everybody was garbage back then. But, if this had become usable, I would expect to have seen articles about using it since then.
[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by loeg on Sunday June 28, 2020 @02:35PM (#23670989)
How do you actually generate a constrained CA certificate? I have tried to do this for a long time but openssl is inscrutable.
[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by est31 on Sunday June 28, 2020 @05:55PM (#23672391)
There seems to be a guide for openssl here [0] but it seems kinda complicated. This discussion inspired me to add name constraints support to rcgen [2]. If you aren't afraid to write Rust, you should give using it a try.

[0] https://www.marcanoonline.com/post/2016/09/restrict-certific...

[1] https://tools.ietf.org/html/rfc5280#page-41

[2] https://github.com/est31/rcgen/commit/059cc19fcd1b8bb57feed5...

[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by loeg on Monday June 29, 2020 @12:48AM (#23674439)
Thanks!
[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by p2t2p on Sunday June 28, 2020 @12:34PM (#23669949)
It is no more complicated than a self signed certificate. Two clicks in Firefox, 4 taps in iOS
[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by elcritch on Sunday June 28, 2020 @06:17PM (#23672522)
Every time and no tracking if device indentity changes.
[ Parent | on HN ]