1

I'm trying to set up cURL to get data from remote server at any sitaution. I use --tlsv1.3 --tls13-ciphers TLS_CHACHA20_POLY1305_SHA256 --http2 to make it as secure as I can think of, using Windows 11. (tried http3 but cURL said it's not fully implemented yet). using the built-in cURL in Windows which uses Schannel, haven't installed or modified it.

I normally use remote server's domain address, but I want to make sure that cURL will work even when local DNS isn't unavailable, so I set it to use remote server's IP addresses if it can't use its domain name, and when it happens, it won't be able to check CRL list and will show this error:

curl: (35) schannel: next InitializeSecurityContext failed: Unknown error (0x80092013) - The revocation function was unable to check revocation because the revocation server was offline.

which I can prevent by adding --ssl-no-revoke

Server is Azure with trusted certificate. I want to know 2 general things:

  1. in terms of security, do I really need cURL to check if the server certificate isn't revoked since Windows already takes care of it automatically with Windows updates and such and cURL uses OS certificate store's trust chain? if so, what additional security benefits can it provide?
  2. what are the security risks, if any, when using --ssl-no-revoke in cURL on Windows? the connection is still TLS 1.3 with aforementioned cipher suite.

1 Answer 1

2

in terms of security, do I really need cURL to check if the server certificate isn't revoked since Windows already takes care of it automatically with Windows updates and such and cURL uses OS certificate store's trust chain?

Windows updates and OS certificate store have nothing to do with checking the revocation of specific server certificates.

In general certificate revocation is a sad story - many important programming languages (like Python, PHP, Ruby ...) don't do it and don't even provide a simple to use interface so one could implement the check themselves. Browser are somewhat better but not perfect - they usually check revocation on EV certificates and on domains deemed important by the browser vendor - see How well do current browsers handle certificate revocation?.

Still, checking for revocation is important for security. It allows to detect certificates which are compromised and which thus might be used by attackers to impersonate a server or to MITM this server. But, if you don't check the revocation you are only as bad as many of the others.

If not checking the revocation as acceptable for you depends on the security requirements of your specific use case, i.e. how likely a compromise of the specific server certificate is and what the impact is if you connect to an impersonated server or MITM. No clear recommendation can be given here.

but I want to make sure that cURL will work even when local DNS isn't unavailable, so I set it to use remote server's IP addresses

In general it is not a good idea to use the IP address in the URL. A multi-homed server with multiple certificates per IP address will require that the server_name is given in the TLS handshake - see Server Name Indication for details. Without this the TLS handshake will fail or the wrong certificate might be returned.

In addition the client (curl) is not able to check the domain name against the certificate since the expected domain name is not provided to curl. But checking the name in the certificate is essential to protect against MITM attacks.

For dealing with unavailable DNS you can set up your own local DNS server, provide the relevant mappings in the hosts file or set you own mappings in curl using the --resolve argument. See Name resolve tricks for more.

4
  • But what about Cloudflare or Google that offer IP address based DoH API like this which doesn't need DNS to be reachable. if --ssl-no-revoke is used with them with TLS 1.3 and strong cipher suite, can a 3rd party MitM my connection or feed me wrong queries etc.?
    – user286246
    Commented Jan 14, 2023 at 15:33
  • 1
    @Jameschad: If the server expects to be accessed by IP address then the certificate will also include the IP address - check here for how the certificate for 1.1.1.1 currently looks like and specifically look at X509v3 Subject Alternative Name. In this case a proper TLS client will verify that the IP address is in the certificate. Most servers will not expect to be accessed by IP though and will not have an IP in the certificate. To access these with IP address in curl works only if you disable certificate validation - bad idea. Commented Jan 14, 2023 at 15:52
  • Thank you, I see the IP addresses are available in the certificate and Cloudflare expects people to connect to its server using IP address. so having a proper TLS client on Windows, up to date Schannel, not checking the revocation, only for Cloudflare and Google servers that allow direct IP connection and explicitly mention their IPs in their certificate, will not allow the connection to be compromised by any 3rd party. is that a correct conclusion?
    – user286246
    Commented Jan 14, 2023 at 16:11
  • 1
    @Jameschad: The conclusion is not correct. Not checking revocation is still is a problem. But with Cloudflare you could at least check that the certificate is matching what you expected, whereas you could not do this when accessing a typical other site by IP since most do not provide a certificate matching the IP. Commented Jan 14, 2023 at 17:13

You must log in to answer this question.