Re: [TLS] [pkix] New version of Multiple OCSP mode of Certificate Status

["Miller, Timothy J." <[e-mail]>]

>You mean that this web-server is sending a server certificate from a
>certification path that ends at a self-signed rootCA which the browser
>already trusts, but the server does not include the intermediate CA
>certificate that is necessary to validate the server certificate?

>An implementation compliant to any of the TLS v1.x specifications
>would have to abort the handshake with such a server due to an
>clear protocol violation.  The server MAY omit the self-signed
>rootCA cert at the end of his certification path, but omitting
>any of the intermediate CA certs is not permitted.

Consider:

- Agency A and Agency B each have internal PKIs.
- Agency A and Agency B mutually cross-certify.
- An End Entity from Agency A connects to an Agency B service.
- The service provides a ServerCertificate message containing it's certificate and the complete path.
- Complying with TLS1.2, the path supplied by the service may or may not include the Agency B's root CA certificate.

>From the user's perspective, the path supplied by the service is *both* compliant with TLS *and* incomplete, because it does not terminate at the Agency A trust anchor.  The server can do nothing to help, because the server has no way to predict *which* certificate path will be acceptable to the client, and in a large bridged environment the number of possible paths can be very, very large.

On the other hand, a browser has two options.  It can fail path validation (which usually results in a warning and a click-through), or it can enter path *discovery*, find the A->B cross certificate, and validate that path instead.  (While in the simple case here this is trivial, in the broader case--e.g., the FBCA environment--it is not.)

Failure is not the correct option because a trust path *does* exist.

I think the problem here is TLS presumes a simple PKI.  To quote from TLS1.2 7.4.2, "[The Server Certificate] message conveys the server's certificate chain to the client."  This is demonstrably not true (see above); the Server Certificate message conveys *one possible* chain to the client.  If that chain is not acceptable to the client, the client *must* find one that is.

-- Tim