mainSavannah Administration - Support: sr #106474, CN in TLS certificate...

 
 

sr #106474: CN in TLS certificate (savannah.*gnu.org) is too broad -- use SubjectAltNames instead.

Submitter:  Daniel Kahn Gillmor <dkg>
Submitted:  Fri 22 Aug 2008 05:02:30 PM UTC
   
 
Category:  Savannah website Priority:  5 - Normal
Severity:  3 - Normal Status:  Done
Privacy:  Public Assigned to:  Beuc
Operating System:  None Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 13 Sep 2008 07:18:14 PM UTC, comment #3: 


> though the current certificate doesn't properly indicate savannah.nongnu.org, as you know


Hmmm, actually that's a mistake that I shamelessly didn't test -_-'

Fixed now.

I had decided to use 2 certs in a first step with CAcert. We have the 2 IP addresses at the moment, though it'd be good to use only one in the long run.

Sylvain Beucler <Beuc>
Sat 13 Sep 2008 05:59:37 PM UTC, comment #2: 

Switching to CAcert probably is a good idea (though the current certificate doesn't properly indicate savannah.nongnu.org, as you know).

I actually looked at certtool before submitting this ticket, and couldn't figure out how to get two SubjectAltNames into either a certificate request or an actual certificate.  I can do it with OpenSSL, but i understand that's not a GNU tool (and isn't even GPL-compatible.  sigh).  I just saw your post to help-gnutls, which i'm assuming is about this cert.  I hope to learn from the answers on that list!

Daniel Kahn Gillmor <dkg>
Sat 13 Sep 2008 02:33:43 PM UTC, comment #1: 

We just switched to CAcert which essentially solves the issue.
I agree using wildcards wasn't such a good idea.

Note: if you know how to use 'SubjectAltNames' in GnuTLS' certtool I'm interested.

Sylvain Beucler <Beuc>
Fri 22 Aug 2008 05:02:30 PM UTC, original submission:  

In the TLS certificate used by the savannah web site (both gnu and nongnu), the subject DN appears to be:

/C=US/O=FSF/OU=Savannah/CN=savannah.*gnu.org/

The CN (the relevant piece checked by most TLS implementations against the hostname of the server in the absence of the SubjectAltNames extension) is far too broad.

If one was to accept this certification, the implication is that the holder of this certificate could register "ihategnu.org", put up a server at "savannah.ihategnu.org", and use the same certificate/keypair.  If the CA issuing the cert (the savannah CA?  the FSF CA?) wants its certifications to be taken seriously, it should probably avoid issuing certs with such broad CNs.

A better strategy would be to leave the CN as savannah.gnu.org, but add the X.509v3 SubjectAltName extension, containing two DNS names: savannah.gnu.org and savannah.nongnu.org.

Daniel Kahn Gillmor <dkg>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by Beuc (Posted a comment)
  • -email is unavailable- added by dkg (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2008-09-13 Beuc StatusNone Done
        Assigned toNone Beuc
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-bb6a.
    Corresponding source code