Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Can attribute certificates (also known as authorization certificates) be used with HTTPS? For instance, can a HTTPS server supply an attribute certificate in addition to its ordinary SSL certificate? If yes, what will browsers do when they see it? Do they ignore it? Do they validate it (check that's signed by a trusted CA)?
For instance, I found RFC 5878, which describes a TLS extension for supporting attribute certificates, but I can't tell whether it is supported by browsers.
RFC 5878 is experimental, and therefore not required to be compliance with TLS proper. As far as I can tell, based on cursory searches, OpenSSL has headers related to 5878 (e.g. TLSEXT_TYPE_client_authz, TLSEXT_TYPE_server_authz), but does not appear to be used in either Chrome or Firefox's source code. It's non-trivial to tell if other browsers support it (e.g. Opera, Safari, Internet Explorer) without actually testing it, which I do not have the time to do at the moment. Both Chrome and Firefox could easily support it through their related extension APIs, or could even easily be patched to support the extension if you wanted to use that internally for an organization. Finally, I suspect that if there was support for it, a cursory Google search would confirm it, but the lack of any documentation speaks volumes.
