1

I've read the great post written by @Thomas Pornin Which properties of a X.509 certificate should be critical and which not?

and it raised my question.

STORY:

Let's assume that I have a client C and a server S. Now, client try to connect to S by SSL. Therefore, S presents its certificate CERT. Now, C tries to verify a S. For that moment we can ommit signature verification and hostname verification details and focus on extensions. Obviously, C uses OpenSSL to verify certificate.

But, for some critical extensions OpenSSL says: I don't support that.

PROBLEMS:

  1. What I should do? I suppose that I should writting a code that verifies extensions not supported by OpenSSL, yes?

  2. Especially, how to verify an extension? I can implement it on my own but I have to know what does it mean to verify/validate an extension. Please help.

3

...but I have to know what does it mean to verify/validate an extension...

There is no generic rule how an extension should be verified. The rules depend instead on the specific extension and are usually documented in the standard where the specific extension is defined.

Thus, if the certificate contains an extension which is marked as critical and which is not specifically addressed by either the TLS library or by your application according to the rules specific to this extension type than you should not accept the certificate.

  • Thanks for your reply :). I suppose that there is no general rule, but can you give an example? – Gilgamesz Sep 18 '17 at 9:54
  • @Gilgamesz: I'm not sure what kind of example you expect. The rule you have to follow is: look at the standard and implement what you'll find there. If you want to see how such a standard looks like take a look for example at RFC 5280 and study the documentation for basicConstraints in section 4.2.1.9. – Steffen Ullrich Sep 18 '17 at 10:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.