1

My apologies if this is too subjective, but I am looking for advice on best practices. We maintain a small program written in Python that runs on our customers' servers and communicates back with our servers. We are using Python's ssl module which relies on openssl to protect this communication back to our servers. This program is run on older Linux systems (think RHEL5) as well as Windows variants. (Yes, the ssl module doesn't come by default with Python 2.4, but please ignore that issue for the sake of this question.)

Our plan is to include a file with the program containing the certificate authority that issued our current SSL certificate, as well as some other authorities that we may use in the future. That way, we know that no matter what is on the customer's servers, our certificate authority will be trusted.

Is this reasonable, or does openssl provide a good enough list of certificate authorities even for old openssl versions that we should not need to worry about this ourselves? Are there any issues we should also consider with regards to providing our own certificate authority list, beyond just locking us into that list for future SSL certs?

  • Why not sign the certificates yourselves? Then you only need one entry in the list, and you don't need to pay CA's for that. Other option: use DANE. You only need to ship with one key then. – user10008 Aug 27 '14 at 21:57
  • We could sign it ourselves, but since we already have a certificate issued by a well known CA to handle our normal web https traffic, it doesn't cost us anything more to re-use that certificate.We have thought about including an entry in the CA list for a certificate authority of our own making just in case we do want to issue a certificate against that authority in the future. – Steven Aug 27 '14 at 22:29
  • Does OpenSSL really ship with its own list of trusted CA servers? I'd guess that this list is managed by the OS instead. – user10008 Aug 28 '14 at 4:04
  • After doing more digging, I realized Steffen's post below is correct -- OpenSSL no longer ships with a list of trusted CA certificates -- it just has a directory to hold them. The individual Linux distributions figure out ways to populate that directory. – Steven Aug 28 '14 at 5:52
3

OpenSSL does not come with a list of trusted certificate agencies, it only has a default path where it looks for these CA. On Linux and *BSD this path is usually populated by the OS, often based on the list Mozilla uses in the Firefox browser.

But, there is no such list on Windows, because OpenSSL can not deal with they way windows stores the certificates. There is also no such list on OS X, but Apple added a hack to OpenSSL as shipped on Mac OS X to somehow integrate into their native key chain.

This means, if you want to have a controlled behavior you better ship with your own list of trusted CA. And if the program should only connect back only to your server it might be the best to include only the CAs relevant for this task.

  • Thanks for the answer. You are right that I was mistaken about OpenSSL including a list of trusted CAs. – Steven Aug 28 '14 at 5:54
1

Usually you can say that maintaining the OS' CA list is the responsibility of the admins of the client servers. Even if it weren't for your application, they should maintain that list, as long as there are applications that rely on it. If you have special requirements for the security of the https connection, you could run your own CA, and create a special subdomain on your server to serve a cert signed by your own CA.

Every additional CA on the list is one security risk more. Especially when the list is badly maintained, events like the problem with the indian CA go unnoticed.

However, always leave an option to add custom certificates on the client side, as some companies have proxies which intercept outgoing https traffic, decrypting, and then re-encrypting it. A custom CA might be a problem for those proxies, so when you create your CA, make it sure it only covers your domain, so that you can convince your customers to add your CA to the proxie's trusted CAs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.