3 ms·
The point is the vulnerable code will execute any time a trusted certificate is being validated. If you have a service that depends on mTLS, then your service i
by NovemberWhiskey 4y ago
The point is the vulnerable code will execute any time a trusted certificate is being validated. If you have a service that depends on mTLS, then your service is (by definition) validating client certificates so you can't mitigate your exposure.
There is a separable question of whether your service trusts certificates issued by a CA that might produce a certificate with a SAN of the necessary form to trigger the exploit.
- couchand 4y agoIf you rely on mTLS you highly likely run your own CA. You can probably say with confidence that no malicious certificates have been signed by your CA. So you mitigate your exposure by ignoring certs without a valid chain of trust, which you're doing anyway. Am I missing something?