IETF Logo Mail Archive

Re: [TLS] Verifying X.509 Certificate Chains out of order

Mike <mike-list@pobox.com> Mon, 06 October 2008 22:58 UTC

Return-Path: <tls-bounces@ietf.org>
X-Original-To: tls-archive@ietf.org
Delivered-To: ietfarch-tls-archive@core3.amsl.com
Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5D55128C120; Mon, 6 Oct 2008 15:58:00 -0700 (PDT)
X-Original-To: tls@core3.amsl.com
Delivered-To: tls@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 759CE28C120 for <tls@core3.amsl.com>; Mon, 6 Oct 2008 15:57:59 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A+wtnSTesX89 for <tls@core3.amsl.com>; Mon, 6 Oct 2008 15:57:58 -0700 (PDT)
Received: from sasl.smtp.pobox.com (a-sasl-quonix.sasl.smtp.pobox.com [208.72.237.25]) by core3.amsl.com (Postfix) with ESMTP id C0CD73A676A for <tls@ietf.org>; Mon, 6 Oct 2008 15:57:58 -0700 (PDT)
Received: from localhost.localdomain (localhost [127.0.0.1]) by a-sasl-quonix.sasl.smtp.pobox.com (Postfix) with ESMTP id 114B087D07 for <tls@ietf.org>; Mon, 6 Oct 2008 18:58:33 -0400 (EDT)
Received: from [192.168.1.8] (wsip-24-234-114-35.lv.lv.cox.net [24.234.114.35]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by a-sasl-quonix.sasl.smtp.pobox.com (Postfix) with ESMTPSA id DE93687D06 for <tls@ietf.org>; Mon, 6 Oct 2008 18:58:31 -0400 (EDT)
Message-ID: <48EA97D9.5040606@pobox.com>
Date: Mon, 06 Oct 2008 15:57:29 -0700
From: Mike <mike-list@pobox.com>
User-Agent: Thunderbird 2.0.0.14 (Windows/20080421)
MIME-Version: 1.0
To: tls@ietf.org
References: <200810061909.m96J9axT010938@fs4113.wdf.sap.corp>
In-Reply-To: <200810061909.m96J9axT010938@fs4113.wdf.sap.corp>
X-Pobox-Relay-ID: 4CCD0F14-93FA-11DD-AFB3-F4FB75724C3F-38729857!a-sasl-quonix.pobox.com
Subject: Re: [TLS] Verifying X.509 Certificate Chains out of order
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Sender: tls-bounces@ietf.org
Errors-To: tls-bounces@ietf.org

> It is a big waste to sort and sort and sort the list each time
> it is processed.  The one who is persisting the data (credential holder)
> can sort it once and for all.

As another data point, my software will first attempt to validate the
certificate chain in the order it was received, but if it finds that
one certificate did not issue the previous one, it then attempts to
put them in the correct order and revalidate the chain.

I had to do this sometime last year because I couldn't connect to one
of the major credit card companies' websites with my own software, but
my browsers were able to.  An additional problem with that site was
their CRL was PEM encoded!

As has been said, be liberal in what you accept....

Mike
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

v2.23.0 | Report a Bug | By Email