Re: [TLS] WWW-Authenticate challenge for client-certificates

[Marsh Ray <[e-mail]>]

Bruno Harbulot wrote:
> 
> IIS (and the .Net HTTP framework) seems to be configured by default not
> to request a certificate, but to request one only at a later point,
> depending on what the HTTP request is trying to access. I'm not sure if
> this is the commercial vendor you had in mind, but this one does indeed
> use re-negotiation by default (unless configured with
> clientcertnegotiation=true with netsh), but I can't find much
> information from MS about CVE-2009-3555 anyway.

Configuring a multi-purpose web server to allow an optional client
certificate can have the side effect of popping up a 'choose cert'
dialog in the user's web browser, whether they are likely to need one or
not. Not something you want on your home page.

I think it's mainly for this reason that certs are not accepted on the
initial connection.

> Yes, I think such a header 'WWW-Authenticate' could also include a
> parameter to have a hint of which certificate to send. I'm not sure
> whether the request resent should have an 'Authorization' header, since
> the credentials would be obtainable from the the TLS layer anyway.

You might have to specify everything that would be specified in the TLS
Certificate Request message, and add to that your enhancements.

RFC 2246:
>        enum {
>            rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
>            (255)
>        } ClientCertificateType;
> 
>        opaque DistinguishedName<1..2^16-1>;
> 
>        struct {
>            ClientCertificateType certificate_types<1..2^8-1>;
>            DistinguishedName certificate_authorities<3..2^16-1>;
>        } CertificateRequest;
> 
>        certificate_types
>               This field is a list of the types of certificates requested,
>               sorted in order of the server's preference.
> 
>        certificate_authorities
>            A list of the distinguished names of acceptable certificate
>            authorities. These distinguished names may specify a desired
>            distinguished name for a root CA or for a subordinate CA;
>            thus, this message can be used both to describe known roots
>            and a desired authorization space.
> 
>  Note: DistinguishedName is derived from [X509].
> 
>  Note: It is a fatal handshake_failure alert for an anonymous server to
>        request client identification.

- Marsh