Re: Understanding SSL_SetTrustAnchors

Hi Rob,

I am not familiar with this code, but I just looked into it and can
answer your questions based on my findings.

On Tue, Mar 15, 2016 at 7:14 AM, Rob Crittenden <[email protected]> wrote:
> I want to control the set of CA certificates available to authenticate
> client certificates. AIUI I can use SSL_SetTrustAnchors() to do this but it
> isn't working as I'd expect.
>
> The code looks like:
>
> CERTCertList * ca_list = CERT_NewCertList();
> SSL_SetTrustAnchors(fd, ca_list); (returns SECSuccess)
> .... rest of the handshake ...

I found that SSL_SetTrustAnchors only affects the CertificateRequest
handshake message, which is used by a server to request a client
certificate.

SSL_SetTrustAnchors does not affect how the server verifies a client
certificate.

> So I'm setting it to an empty list which, as I understand it, no client
> certs should be accepted. But I find that client certs are still successful
> when client auth is required.

In this case, I believe your server will send a CertificateRequest
handshake message that contains an empty certificate_authorities list.
I understand certificate_authorities is a whitelist and therefore an
empty whitelist seems to imply no CA is allowed. But this is actually
interpreted as every CA is allowed. See this quote from the TLS 1.2
RFC:

   certificate_authorities
      A list of the distinguished names [X501] of acceptable
      certificate_authorities, represented in DER-encoded format.  These
      distinguished names may specify a desired distinguished name for a
      root CA or for a subordinate CA; thus, this message can be used to
      describe known roots as well as a desired authorization space.  If
      the certificate_authorities list is empty, then the client MAY
      send any certificate of the appropriate ClientCertificateType,
      unless there is some external arrangement to the contrary.

> I'm testing using a CA which has two subordinate CA's, one for clients and
> one for servers. All three CA's are trusted in my server database.

You should call SSL_SetTrustAnchors with a ca_list argument that
contains only the subordinate CA for client certificates, Do not add
the root CA to ca_list.

And your client certificate verification callback needs to only allow
a client certificate issued by that subordinate CA. As I noted above,
SSL_SetTrustAnchors won't cause NSS to screen the received client
certificates for you.

Wan-Teh Chang
-- 
dev-tech-crypto mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-tech-crypto