Re: [TLS] Certificate validation can of worms

[Rob Stradling <[e-mail]>]

On 07/04/14 22:30, Martin Rex wrote:
<snip>
> There is *NO* such requirement (to look at EKU) anywhere in rfc5246
> and rfc2818.  The EKU processing within the PKIX certificate path validation
> applies only to path certificates, not to the leaf certificate (because the
> certificate path validation is context-free, i.e. independent of the
> actual usage of the certificate.

Martin, how about RFC6125?

"Representation and Verification of Domain-Based Application Service
  Identity within Internet Public Key Infrastructure Using X.509 (PKIX)
      Certificates in the Context of Transport Layer Security (TLS)
...
1.4.  Applicability

    This document does not supersede the rules for certificate issuance
    or validation provided in [PKIX].  Therefore, [PKIX] is authoritative
    on any point that might also be discussed in this document.
    Furthermore, [PKIX] also governs any certificate-related topic on
    which this document is silent, including but not limited to
    certificate syntax, certificate extensions such as name constraints
    and extended key usage, and handling of certification paths."

<snip>
> Did you notice that the id-kp-serverAuth that is defined in rfc5280
> is strictly limited to HTTP-over-TLS anyway, so would not apply to
> XMPP-over-TLS, SIP-over-TLS, SMTP-over-TLS and whathaveyou.

You mean the "-- TLS WWW server authentication" comment in section 
4.2.1.12?  Or something else?

Would you be happier if "WWW " wasn't in that comment?

>> Similarly, certificate policies and policy constrains extensions should
>> be processed by the client and if the require explicit policy state
>> variable get turned on and the path is not valid for some policy,
>> it must be rejected.
>
> PolicyOIDs are completely meaningless for HTTP-over-TLS.
> Is there *ANY* X-over-TLS specification that gives a meaning
> to any policy OIDs?

Yes.  The CA/Browser Forum EV SSL Guidelines and Baseline Requirements.

<snip>

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online