Re: Trust bits for client auth

Actually, Keeler just reminded me that Firefox doesn't usually verify
client certs, since it's the server's opinion of validity that matters.
I'll let him chime in with more detail.

On Wed, Feb 10, 2016 at 12:57 PM, Richard Barnes <[email protected]>
wrote:

> I happen to have been looking at this code today!  It turns out (rather
> surprisingly) that the root is required to have the email trust bit.
>
>
> https://dxr.mozilla.org/mozilla-central/source/security/certverifier/CertVerifier.cpp?from=CertVerifier.cpp#248
>
> (If someone wanted to file a bug to change that, I might be favorably
> disposed.) Skimming through certdata.txt, it looks like most of the
> included roots have this bit set.
>
> On Wed, Feb 10, 2016 at 12:30 PM, <[email protected]> wrote:
>
>> Does Firefox put any restriction on which roots are trusted to issue
>> client auth certs? Does the root require a particular trust bit?
>> _______________________________________________
>> dev-security mailing list
>> [email protected]
>> https://lists.mozilla.org/listinfo/dev-security
>>
>
>