Re: [Spasm] [saag] Best practices for applications using X.509 client certificates

[David Woodhouse <[e-mail]>]

On Tue, 2016-09-20 at 11:43 -0400, Alan DeKok wrote:
> On Sep 20, 2016, at 10:49 AM, Michael Richardson <[e-mail]> wrote:
> > 
> > I think that the major problem with X.509 client certificates is that many
> > applications and protocols don't know if 509 is being used as a container for
> > a self-signed certificate, for poorly(privately) signed certificate, a
> > corporate CA, or a webCA.
> > 
> > That's where PHB's suggestion of a new meta-format would win.
> > (It means that we could eventually not have the keys in X.509 format.)
> 
>   This proposal may be applicable:
> 
> https://tools.ietf.org/html/draft-winter-opsec-netconfig-metadata-00

That looks like a layer above what I'm talking about. My goal is that
we should be able to refer to certificates in a simple consistent way.

If the certificate is in a system store then applications should allow
it to be used by means of a consistent identifier string (which is
defined by RFC7512 for PKCS#11, and may be different for OSX/Windows
system certificate stores).

If the certificate is in a file, obviously the identifier is the
filename... but we need to fix applications so that they actually
*accept* all types of files. Which as I said, none of them do at the
moment.

Looking at the proposal above, I see there is some attempt to handle
certificate encodings — it the CertEncodingEnum has values of PEM, DER,
and P12.

This looks a lot like the problematic applications we need to fix...
for PKCS#1 and PKCS#8 you have to manually specify whether it's PEM or
DER file even though the software could work that out for itself. And
for PKCS#12 you *don't* have to specify; it's going to assume DER. All
very suboptimal.

My assertion is that applications shouldn't *need* that nonsense, and
should just take the filename and deal with the contents. Please don't
entrench that horridness further.

It also seems that the proposal you reference doesn't have any kind of
support for using keys from hardware. If the key I want to use is
identified by an RFC7512 PKCS#11 URI, how do I indicate *that* in this
format?

-- 
dwmw2