3 ms·
I don't like this solution, mainly because installing custom CA certificates increases the chance of a MITM attack involving other services. Any trusted "inter
by maxdamantus 5y ago
I don't like this solution, mainly because installing custom CA certificates increases the chance of a MITM attack involving other services.
Any trusted "intermediate" certificate in X.509 is allowed to be a CA, so it can be used to sign certificates for any domain. If an attacker gets the private key for that certificate which has been manually installed on everyone's PC, they can impersonate any website, including external web mail, etc, until someone manually removes the certificate again from all the PCs.
In the past when we've used custom CAs for test environments, I've preferred to just deal with the TLS warnings instead of trusting a non-standard CA on the computers I use.
- pabs3 5y agoPerhaps the CA could be constrained to only sign certs for *.foo.local?
- maxdamantus 5y agoAs far as I know, X.509 doesn't currently have such a concept, and web browsers don't have it either. If you install a certificate as a CA, it is a CA for any domain. If a CA signs another certificate with the "Certificate Sign" flag (intermediate certificate), that other certificate is also a CA for any domain. The subject name fields are not used when validating authority as a CA.
- pabs3 5y agoWell, there is the name constraints mechanism, but I'm not sure how well supported that is in TLS libraries and web browsers. https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10 https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.... https://timothy-quinn.com/name-constraints-in-x509-certificates/ https://timothy-quinn.com/name-constraints-in-x509-certifica... https://www.sysadmins.lv/blog-en/x509-name-constraints-certificate-extension-all-you-should-know.aspx https://www.sysadmins.lv/blog-en/x509-name-constraints-certi... https://blog.codekills.net/2012/04/08/adventures-in-x509-the-utterly-ignored-nameconstraints/ https://blog.codekills.net/2012/04/08/adventures-in-x509-the...
- maxdamantus 5y agoThanks, I wasn't aware of that. I guess I'd feel a bit more comfortable installing a CA with those constraints, though I'd wonder how many administrators actually know to do it—seems like a feature that's not currently well known and something that can be easily overlooked. There would also be risks to users if installing these custom CAs became common practice. It might be safe to do it for certificates with suitable name constraints, but until certificate installation UIs add something special for this ("this certificate has authority over X, Y, Z"), users aren't going to distinguish between safe/unsafe (constrained/unconstrained) CAs.
- btown 5y agoThey seem decently well supported, see e.g. https://nameconstraints.bettertls.com/#!view?results=chrome_63_osx10.13.3 https://nameconstraints.bettertls.com/#!view?results=chrome_... and https://nameconstraints.bettertls.com/#!view?results=firefox_50_windows https://nameconstraints.bettertls.com/#!view?results=firefox...
- tialaramex 5y agoHowever, note that some relatively modern versions of Safari (because of course) don't support this constraint. This might be no problem for you, or, it might be a complete showstopper.
- jesboat 5y agoIt does; they're called "name constraints". This page https://systemoverlord.com/2020/06/14/private-ca-with-x-509-name-constraints.html https://systemoverlord.com/2020/06/14/private-ca-with-x-509-... claims they're supported by "all current browsers". x509 extensions can be marked "critical" or not. If the name constraint was marked critical, then AIUI old software should (in theory) fail secure, and reject everything signed by the CA.
- kevin_thibedeau 5y agoYou just run your own CA and install that as a trusted root. Then you aren't vulnerable to external parties and you don't have to deal with alarm bells over self-signed certs.