0

Is it possible to issue an SSL certificate that limits the certificate holder to issuing https redirects? Or more generally, limiting the holder to issuing specified data through the secure pipe, once it has been established?

I would like to let edge nodes issue https redirects. It is impracticable to lock down the edge nodes to the extent needed. Normally, to issue https redirects I would use a normal ssl certificate, however that would allow the edge node to return any data it wished, which is a huge security hole. This is a problem with certifying a pipe, not the data that goes through the pipe.

Any recommendations, or secure alternatives, would be welcome.

Thanks in advance, Max

Improve this question
7
  • Note: I assume that for redirect-only https certificates to exist there would have to be (1) an X509 extension that expresses the restriction and (2) browsers would have to support the extension. There does not seem to be a nice list of supported X509 extensions, that is either short enough to read through manually or searchable. If you know of one, please let me know!
    – Max Murphy
    Sep 7, 2021 at 9:30
  • 1
    There is no such extension and no such standard. Limit on HTTPS redirection is configured on client only and does not rely on connection type (HTTP or HTTPS). Look at this thread: stackoverflow.com/questions/10895406/…
    – Crypt32
    Sep 7, 2021 at 9:42
  • 2
    This sounds a lot like an XY problem. Why do you want to issue a redirect-only certificate?
    – MechMK1
    Sep 7, 2021 at 11:56
  • @MechMK1 Because the server that terminates the https connection cannot be fully trusted.
    – Max Murphy
    Sep 7, 2021 at 22:25
  • @MaxMurphy If the server that terminates the HTTPS connection cannot be fully trusted, your architecture is broken. This still sounds like an XY problem even with that clarification. Why is the server untrusted? What are you actually trying to achieve?
    – Polynomial
    Sep 8, 2021 at 0:10

1 Answer 1

Reset to default
2

No, there is no way to do that.

There is no SSL/TLS standard to restrict usage as HTTP server to only issuing HTTP 301 responses.

Improve this answer
8
  • What proof do you have? What extensions have you checked?
    – Max Murphy
    Sep 7, 2021 at 23:08
  • @MaxMurphy This answer is correct. The HTTP protocol is separate to the TLS protocol. Once the TLS session has been created, the underlying data going through that session is completely agnostic and effectively opaque. Preventing such redirects at the TLS layer would require the protocol to inspect the underlying application-layer protocol. There is no such extension.
    – Polynomial
    Sep 8, 2021 at 0:09
  • @MaxMurphy What do you expect me to do? Show you the entire source code of every browser there is, just to show that there is no check for some TLS extension?
    – MechMK1
    Sep 8, 2021 at 0:53
  • The TLS protocol does not care about what is being encapsulated on it.
    – ThoriumBR
    Sep 8, 2021 at 18:45
  • @ThoriumBR But a TLS certificate can hold certain extensions, which can be relevant to HTTP. It's not unthinkable that such an extension could exist - it just doesn't.
    – MechMK1
    Sep 9, 2021 at 11:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.