Can attribute certificates (also known as authorization certificates) be used with HTTPS? For instance, can a HTTPS server supply an attribute certificate in addition to its ordinary SSL certificate? If yes, what will browsers do when they see it? Do they ignore it? Do they validate it (check that's signed by a trusted CA)?

For instance, I found RFC 5878, which describes a TLS extension for supporting attribute certificates, but I can't tell whether it is supported by browsers.


RFC 5878 is experimental, and therefore not required to be compliance with TLS proper. As far as I can tell, based on cursory searches, OpenSSL has headers related to 5878 (e.g. TLSEXT_TYPE_client_authz, TLSEXT_TYPE_server_authz), but does not appear to be used in either Chrome or Firefox's source code. It's non-trivial to tell if other browsers support it (e.g. Opera, Safari, Internet Explorer) without actually testing it, which I do not have the time to do at the moment. Both Chrome and Firefox could easily support it through their related extension APIs, or could even easily be patched to support the extension if you wanted to use that internally for an organization. Finally, I suspect that if there was support for it, a cursory Google search would confirm it, but the lack of any documentation speaks volumes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.