IETF Logo Mail Archive

Re: [Emu] [lamps] EAP/EMU recommendations for client cert validation logic

Michael Richardson <mcr+ietf@sandelman.ca> Fri, 17 January 2020 18:29 UTC

Return-Path: <mcr+ietf@sandelman.ca>
X-Original-To: emu@ietfa.amsl.com
Delivered-To: emu@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E841B120043; Fri, 17 Jan 2020 10:29:41 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.199
X-Spam-Level:
X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7h9MfE0IHloL; Fri, 17 Jan 2020 10:29:39 -0800 (PST)
Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3EDB2120025; Fri, 17 Jan 2020 10:29:38 -0800 (PST)
Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 2E2363897D; Fri, 17 Jan 2020 13:29:09 -0500 (EST)
Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 8F0E05D4; Fri, 17 Jan 2020 13:29:37 -0500 (EST)
From: Michael Richardson <mcr+ietf@sandelman.ca>
To: "spasm@ietf.org" <spasm@ietf.org>, EMU WG <emu@ietf.org>
In-Reply-To: <FC4AEADF-10B3-490C-8A32-3458AA86C497@deployingradius.com>
References: <MN2PR11MB3901F9B86DAC83AF67FBA49DDB560@MN2PR11MB3901.namprd11.prod.outlook.com> <CAErg=HEzR4U9L2Bbj65hSKo4=GEHv=NVGkySFpdCaK2NoJBmFQ@mail.gmail.com> <MN2PR11MB39013D4C54FEACDC8228D136DB3F0@MN2PR11MB3901.namprd11.prod.outlook.com> <CAErg=HG=ZTbzfSr8oQMWgzFNqmdPkUNttLQDprGo5F6LXv9T5Q@mail.gmail.com> <B823CF84-4F78-4B91-BC68-E173FA78C28D@deployingradius.com> <CAErg=HEAtGiJKpLamdUaHicU2Psu7_0RrwsrwiQpb-uHOZ2p2Q@mail.gmail.com> <B2989B0E-8B6B-4B7A-B871-AF520310B3FC@deployingradius.com> <CAErg=HG06ZpiRUYogiVwoJPsZDsjzAVvO0B4=K=PE7aAHe44rA@mail.gmail.com> <6CEB4C89-B749-4A65-A25A-A12830ED8A62@deployingradius.com> <CAErg=HFPCYKgUEXHaOC0sQECYaVmt0TZXe-uDrKzFiNSAcdckg@mail.gmail.com> <00453E78-D991-4B4D-A138-5788FACC47C2@deployingradius.com> <CAErg=HFYQpfqTE9==TzGo795ZiuNBGVMqWuXS6GJ2DV0nGxPzA@mail.gmail.com> <316CC74D-667B-4A1E-AD48-A702DF705423@deployingradius.com> <CAErg=HF-so7nvNmYd04wJ-DCHYGarkHpt3XjTGOhFNT1h=69UA@mail.gmail.com> <10F5CCFB-7DBD-40DF-9C65-BCD0EB8CB838@deployin gradius.com> <CAErg=HH_VNooEKr2p7ebdDScRorQxEfxJ30YpY7sEu84pk+6eg@mail.gmail.com> <48C23DF2-C578-482B-BCC3-69AABDAF983F@cisco.com> <FC4AEADF-10B3-490C-8A32-3458AA86C497@deployingradius.com>
X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1
X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m<nPbLgmtKK-5dC@#:k
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-="; micalg="pgp-sha256"; protocol="application/pgp-signature"
Date: Fri, 17 Jan 2020 13:29:37 -0500
Message-ID: <3821.1579285777@localhost>
Archived-At: <https://mailarchive.ietf.org/arch/msg/emu/G3e-0kHTMXIif8E_QyRZ5QKC5ms>
Subject: Re: [Emu] [lamps] EAP/EMU recommendations for client cert validation logic
X-BeenThere: emu@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "EAP Methods Update \(EMU\)" <emu.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/emu>, <mailto:emu-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/emu/>
List-Post: <mailto:emu@ietf.org>
List-Help: <mailto:emu-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/emu>, <mailto:emu-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 17 Jan 2020 18:29:42 -0000

Alan DeKok <aland@deployingradius.com> wrote:
    > Perhaps we should try?

    > $ openssl s_client -connect smtp.mozilla.org:587 -starttls smtp > mozilla.crt
    > $ openssl x509 -text -in mozilla.crt

You omitted an important part of that output, which is the name of the CA,
which I include below.
It could be that the CSP permits SMTP, or SUBMISSION service.
Ryan has suggested that CAs could put EAP-TLS (or EAP-TEAP) into their CSP,
and that also seems like an out.

Certainly, some of the excitement for ACME/Letsencrypt with DNS-01 challenge
is that it makes it easy to get a certificate for a non-HTTP thing.

I think we need to fix the lawyers, not the protocol.

The detail:
        Issuer: C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA

       Subject: C = US, ST = California, L = Mountain View, O = Mozilla
       Corporation, OU = WebOps, CN = smtp.mozilla.org

But, let's do some more tests:
dooku-[/var/tmp](2.6.5) mcr 10051 %host letsencrypt.org
letsencrypt.org has address 162.243.166.170
letsencrypt.org has IPv6 address 2604:a880:400:d1::89c:7001
letsencrypt.org mail is handled by 5 alt2.aspmx.l.google.com.

dooku-[/var/tmp](2.6.5) mcr 10052 %echo QUIT | openssl s_client -connect
alt2.aspmx.l.google.com:25 -starttls smtp >| letsencrypt.crt

dooku-[/var/tmp](2.6.5) mcr 10053 %openssl x509 -text -in letsencrypt.crt|
grep Issuer
        Issuer: C = US, O = Google Trust Services, CN = GTS CA 1O1
                        CA Issuers - URI:http://pki.goog/gsr2/GTS1O1.crt

What do CA's do?

dooku-[/var/tmp](2.6.5) mcr 10054 %host digicert.com
digicert.com has address 45.60.121.229
digicert.com has address 45.60.131.229
digicert.com mail is handled by 20 us-smtp-inbound-2.mimecast.com.

dooku-[/var/tmp](2.6.5) mcr 10055 %echo QUIT | openssl s_client -connect
us-smtp-inbound-2.mimecast.com:25 -starttls smtp >| digicert-smtp.crt
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global
Root G2

dooku-[/var/tmp](2.6.5) mcr 10056 %openssl x509 -text -in digicert-smtp.crt|
grep Issuer
        Issuer: C = US, O = DigiCert Inc, CN = DigiCert Global CA G2
                        CA Issuers -
URI:http://cacerts.digicert.com/DigiCertGlobalCAG2.crt

What's that quote about doctor's fixing themselves?


--
Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
 -= IPv6 IoT consulting =-

v2.23.0 | Report a Bug | By Email