Re: [TLS] OCSP must staple

[Brian Smith <[e-mail]>]

On Wed, Jun 11, 2014 at 4:10 PM, Adam Langley <[e-mail]> wrote:

> On Wed, Jun 11, 2014 at 3:49 PM, Brian Smith <[e-mail]> wrote:
> > * TLS intercepting proxies cause trouble.
>
> In Chrome (and, I assume, Firefox) there's the concept of a
> "non-public root" - i.e. a CA root that the user has installed. When
> one is used on a connection we disable pinning. We could also disable
> Must Staple.
>

That is one approach that would address the compatibility issues. However,
I think it would be better to find an approach that doesn't limit
Must-Staple to publicly-trusted root CAs. Otherwise, it will be harder than
necessary to make the case stapling + Must-Staple is a complete replacement
for OCSP fetching.

If my suggestion of making an exception for short-lived certificates isn't
good enough to address the compatibility issue (and it probably isn't) then
we could require that the Must-Staple extension in the end-entity
certificate be ignored unless it is also present in a CA certificate in the
chain. This would work as long as TLS intercepting proxies are not forging
intermediate CA certificates by copying the contents of the original
intermediate CA certificates. The downside is that every CA that would want
to use Must-Staple would have to first issue a new Must-Staple-enabled
intermediate. It would be more work, but probably it would still be less of
a barrier to enabling Must-Staple than waiting for CA management software
to add support for a new extension.

Cheers,
Brian