5 ms·
Most browsers will still connect if the leaf certificate has certificate authority information access extensions, the browser can use them to download intermedi
by sjtgraham 10y ago
Most browsers will still connect if the leaf certificate has certificate authority information access extensions, the browser can use them to download intermediate CAs, and then construct a valid chain back to a trusted root. Does Firefox not do this?
- jwilk 10y agoFrom https://bugzilla.mozilla.org/show_bug.cgi?id=1334485#c11 https://bugzilla.mozilla.org/show_bug.cgi?id=1334485#c11 : Another approach to this problem is to do AIA chasing (that is, fetch the URI in each certificate to attempt to find an issuer). Firefox currently does not do this for performance and privacy reasons. Doing each fetch is slow (you would probably want a cache anyway, and so would still be vulnerable to this attack). Also, a CA (or even an untrusted party, since you can't verify the trustworthiness of the AIA field until after you've already fetched data from it) can use this to track users.