News for hackers. Stuff that matters.

A comment on Chromium and Mozilla to enforce 1 year validity for TLS certificates. Parent comment

Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by toast0 on Sunday June 28, 2020 @01:29PM (#23670411)
Are common certificate validation libraries honoring these constraints?

When I tried to use this many moons ago, most things ignored the constraints; although I could mark the extension critical, and then some (but not all, yay) of the things that didn't understand would refuse the CA.

[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by est31 on Sunday June 28, 2020 @03:09PM (#23671224)
IDK NSS seems to have code to verify it:

https://searchfox.org/mozilla-central/source/security/nss/li...

As does webpki:

https://github.com/briansmith/webpki/blob/482627c40dad2148da...

But haven't tested it (or checked other libraries).

[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by est31 on Monday June 29, 2020 @07:29PM (#23684686)
Update: tested it with openssl and webpki. both claim to have support but it only works with openssl. For webpki I had to file two bugs:

https://github.com/briansmith/webpki/issues/134

https://github.com/briansmith/webpki/issues/135

[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by namibj on Sunday June 28, 2020 @01:36PM (#23670466)
Can you name and shame those that ignored the critical extension? Sounds CVE-worthy. A date to guess the versions you used would also help.
[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by toast0 on Sunday June 28, 2020 @02:31PM (#23670943)
No, it was on the order of 5 years ago; everybody was garbage back then. But, if this had become usable, I would expect to have seen articles about using it since then.
[ Parent | on HN ]