Re: [TLS] OCSP must staple

[Yoav Nir <[e-mail]>]

On Jun 12, 2014, at 9:39 PM, Kurt Roeckx <[e-mail]> wrote:

> On Thu, Jun 12, 2014 at 12:02:40PM +0300, Yoav Nir wrote:
>> Hi, Brian
>> 
>> Interesting stuff. Also good to hear that it's easy to implement, although mileages vary.
>> 
>> Regarding TLS proxies, I can give my perspective, as I work for one vendor. 
>> 
>> <hat type="vendor" status="on">
>> Our fake certificates contain the DNs and alternate names from the original certificate. We don't copy over any extensions that we don't understand. The same is also true of TLS - we don't copy extensions we don't know. That is what allows our proxy to gracefully downgrade HTTP/2 or SPDY clients and gateways to HTTP/1.
>> As for dates, these *are* copied from the original certificate, the reason is that this makes the client behavior similar to whatever it is with the original certificate. We did consider making the certificates short-lived, but decided against it. 
>> </hat>
> 
> I'm wondering if it also strips things it doesn't know but are
> marked critical.

For the server-side half of the connection, a proxy acts as a client, or in certificate terminology, a relying party. If there’s a critical extension it doesn’t understand, it rejects the certificate, and never even gets to the stage of creating a fake certificate.

So there’s the big set of certificate extension, a proper subset of this that are the extensions that the product understands, and a proper subset of that, which are the extensions that it copies. 

Yoav