1

I was wondering if there are papers or well-known algorithms to automate the validation of a Certificate Signing Request (CSR).

Suppose I have a group of trusted services where I expose a "CA service" to dispatch the certificates that are trusted by a the other services. If a new service would like to join the group it must become trustable i.e., it needs to send a CSR toward the "CA service", obtaining its trusted (by the other services in the group) certificate.

For example, I though of using the CN (Common Name) to validate the service e.g., my "CA service" implements a list of trusted FQDNs allowed to receive the certificate in case of a request. But, nothing forbids to a malicious service to fake the CN in the CSR if it steals such list.

So, is there anything in literature or a well-known approach to automate the validation of a CSR?

1
  • There is no standard algorithms to validate request. It always depends on your business and technical requirements. The only validation is mandatory to all validators: you have to validate that signature matches the public key stored in request. All the rest up to your requirements.
    – Crypt32
    Dec 22, 2022 at 15:04

1 Answer 1

4

A CSR by itself is valid if the signature on the CSR fits the public key in the CSR. Anything else is subject to use case specific constraints, i.e. depend on what the certificate should be used for.

For example for certificate used in websites there is DV (domain validation), which checks that the subject alternative names are in control of the sender of the CSR - see ACME protocol for a specific way to automate this.

With certificates used for S/MIME the sender of the CSR should be in control of the email address. And certificates used for code signing have even other requirements. So there is no single way covering all use cases of certificates.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .