[TLS] Certificate handshake message - common config problems

[Martin Rex <[e-mail]>]

Dear TLS,

I have just analyzed an interop problem reported by a customer
that was caused by a misconfigured apache web server of a third
party.

The problem is, that this apache sends a Certificate message
that contains the EndEntity certificate twice in a row,
followed by an otherwise correct chain of 3 CA certificates.

Browsers like Firefox and MSIE do not report this as an error.
MSIE doesn't barf, because AFAIK it applies a generic cert chain building
algorithm to all certs following the initial end entity cert.  I don't
know what kind of algorithm firefox uses in order to eliminate the
duplicated end entity cert.

The cause of the problem is the lack of consistency checks performed
by OpenSSL when building the certificate_list in Certficate handshake
messages.  The SSL&TLS spec are clear that what this server is sending
is not compliant to the protocol.  The only one able to fix this
configuration problem is the operator of the server, and the one
who would be able to prevent this problem from occurring is OpenSSL.


I think it that original protocol requirement (well-formed cert chain)
is a very useful protocol feature, because it can save code,
dynamic memory footprint and cpu-cycles, and it also leads to
much more consistent results if everyone validates _the_same_
certificate path.  Having OpenSSL build the chain before
sending it (in addition to when receiving it) might be a good
idea -- and could catch other errors, such as missing intermediate
certs, immediately and under control of those who are able to
and responsible for fixing it.


What do other implementers think about this issue?


-Martin