Re: [radext] Certficate and certificate chain selection (Was: Re: Review of draft-ietf-radext-radiusdtls)

[Alan DeKok <[e-mail]>]

On Mar 20, 2024, at 4:52 AM, Heikki Vatiainen <[e-mail]> wrote:
> I haven't seen certificate selection used on server or client side. My initial reaction for this is that static configuration has worked fine so far. Then again, when the use of RADIUS/TLS becomes more common, static configuration may be too restrictive.

  I think if we can "look ahead" to allowing dynamic certs, it would be useful.  It's been a decade since the last RADIUS + TLS document update.  We shouldn't wait another decade for the next one.

> Therefore:
> - If SHOULD level key word is kept for trusted CA list, does it apply for both clients and servers?

  I think so, yes.

> - SHOULD implies that the receiver typically takes action when it receives the list, yes?

  Yes.

> - Related to CA list, should use of Server Name Indication (SNI) also be discussed?

  Radsecproxy and FreeRADIUS support SNI.  I think that should be a MUST.

  I've also seen deployments where a hosting provider runs RADIUS for multiple domains on one server.  The "solution" to multiple domains is to issue each domain a certificate signed by the *hosting provider*.  So when domains move providers, all of the certs have to be updated.  This is less than optimal.

> - At the moment, do we know what is good advice (secure, matches real needs, ...)?

   I'm not sure we do.  We might just point to the TLS RFCs and say "do that".

> For example, there's text in the draft about 'clients configured by their source IP address'. If such a client is creative with the CA list and SNI options, would they be able establish a TLS connection they otherwise wouldn't be able to?

  The TLS-PSK draft has substantial text about source IPs.  The goal is to allow IP filtering, and tying authorization / authentication to an IP or range of IPs.  Perhaps this document could incorporate the same text.


  There's also TLS trust expressions as an I-D:  https://datatracker.ietf.org/doc/draft-davidben-tls-trust-expr/

  I've discussed the RadSec / EAP certificate selection issue with the authors.  They believe that the draft will solve the problem, and make it easier for applications to choose a trust store and/or CAs.

  Alan DeKok.