Re: [TLS] draft-ietf-tls-cached-info-14

[[e-mail] (Martin Rex)]

Piyush Jain wrote:
> > Please keep in mind that the certificate chain sequence can be changed at
> > any time. Any mechanism used would need to take that into consideration.
>
> [Piyush] Not sure if I understood it correctly. TLS has strict guidelines on
> sequence of certificates in the chain.

This is the theory.

In theory, theory and practice are the same, in practice, they differ.

Although the SSLv3 and *ALL* TLS specs have always been very clear that
the correct ording of certificates in the TLS Certificate handshake
message is a MUST requirement, as well as that only the self-signed
rootCA cert at the end of the path may be omitted, a number of TLS
implementations are notoriously broken in that they will send arbitrary
garbled paths that may include alien certs and even expired certs in
Certificate handshake messages (rather than telling the server admin
that the configuration is incorrect).
 
Although this is not even mentioned in the TLS spec, a number of
SSL and TLS clients will perform various hacks to accomodate for such
broken TLS server implementations, ranging from simple reordering
of certificate, to the extreme of using only the very first certificate
from the servers TLS Certificate handshake message, throw the remaining
certificates into a large pool of candidate path certificates and
perform a full certificate path discovery.

The latter can lead to seemingly non-deterministic behaviour with some
TLS servers that omit more than the self-signed rootCA cert from the
Certificate handshake message, such as intermediate CA certs, and
the client behaviour changes from handshake failure (untrusted cert)
to successful handshake when that "large pool" of cached certs
coincidentally contains the missing intermediate cert from a prior
TLS handshake with a correctly configured TLS Server whose server
cert was issued by the same (intermediate) CA.


I remember that in march 2001 "https://www.verisign.com" was sending
and expired VeriSign rootCA certificate in the server certificate handshake
message.  When I reported this defect to VeriSign Support, they did
(at least initially) not understand that this indicated (a) a defect
(or at least significant sloppiness) in their server's SSL/TLS
implementation and (b) a server configuration errror.


-Martin