Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Suppose a leaf node creates a certificate for a different domain, acting as a CA.

Do most popular frameworks, or SSL chain validation tools verify the constraints? Are there any I should be concerned with, and remove from my production environment?

Should I be concerned with CA's issuing certificates without basic constraints?

How can I protect my website (as a server operator), and my web browsing session (as a consumer) from certificates generated by leaf nodes, or improperly configured CAs?

share|improve this question

2 Answers 2

up vote 4 down vote accepted

Up to a few years ago (something like 2003 or 2004, if I remember correctly), Internet Explorer was not verifying the "Basic Constraints" extension. When this was discovered, Microsoft promptly published a patch.

On a general basis, the "Basic Constraints" extension is properly verified by all existing validators. Internet Explorer was really the worst student in the class on that matter. It is called "basic" for a reason: it is the simplest X.509 extension to handle.

You protect yourself against badly configured CA by ceasing to trust the relevant trust anchors, and sending lawyers to punish such misbehaviour.

share|improve this answer
    
Since this answer was posted I found an even more detailed question and answer here. –  makerofthings7 Jul 25 '13 at 22:32

Moxie Marlinspike did a lot of SSL research. He presented some of it years ago, among which an overview of browsers ignoring the basic constraints. It seems to have been fixed now in most SSL implementations.

However, http://www.youtube.com/watch?v=ibF36Yyeehw is a very good watch if you want to know more about SSL vulnerabilities :-)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.