3

I have obtained a certificate from GoDaddy. It's usage and constraints are as follows:

Key Usage

Digital Signature, Key Encipherment (a0)

Enhanced Key Usage:

Server Authentication (1.3.6.1.5.5.7.3.1)
Client Authentication (1.3.6.1.5.5.7.3.2)

Basic Constraints

Subject Type=End Entity
Path Length Constraint=None

Using OpenSSL, I am able to use this certificate as a CA and sign certificates. Of course, using the certificate signed by the fake CA gives errors in all browsers.

My question, is this a bug in OpenSSL? Can this be used as an exploit?

I read up on CVE-2015-1793 which focuses more on the alternative chain validation than the ability of OpenSSL to sign certificate using a non-CA certificate.

Thanks for any help.

3

My question, is this a bug in OpenSSL?

You could consider it a bug in OpenSSL that it allows signing by a non-CA certificate. But even if OpenSSL would refuse to do this you could simply change the source code to allow it again. Thus it does not matter much if the code allows you to create such a certificate.

Can this be used as an exploit?

Instead the problem would be if somebody would accept such a certificate. Thus if someone presents a certificate it need to be fully validated by the peer. This validation includes checking all constraints, including that the issuer was a CA.

In the past several implementations had problems with this complete validation and some ignored the CA flag, so in this case the issue could be exploited. But again, this is not the problem of the application used to create the certificate but the one which failed to verify the certificate properly. Because identification by certificate should protect the TLS connection against attacks the application should always assume that an attacker tries to circumvent the validation and thus always do a complete validation of the certificate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.