4 ms·

Does it bother anyone else that the links Amazon provided to their certificates and CRLs are not https?

by aaronpk 11y ago

Titanous 11y ago
The fingerprints are included in the bugzilla ticket and the CRLs are signed with the certificates, so TLS doesn't technically add anything as long as you confirm the fingerprints (though it doesn't hurt anything either).
- aaronpk 11y ago
  Yeah, it just seems odd
  - qrmn 11y ago
    I don't think CRLs usually are, under current infrastructure anyway. How can you verify the certificate of the server when it's signed by the certificate you want to fetch; or check that it hasn't been revoked when what you're connecting to is its own CRL/OCSP? What about the risk of infinite loops? Cross-signatures, or multi-signatures, perhaps; or going opportunistic and simply not minding on that occasion? Nope, for now they just use HTTP, and pin what they need to, to the fingerprint. They should, however, specify an SHA-256 fingerprint. SHA-1 doesn't really cut it anymore. But that's what Mozilla currently require, so that's what Amazon provided. https://wiki.mozilla.org/CA:Information_checklist https://wiki.mozilla.org/CA:Information_checklist
  - MichaelGG 11y ago
    No it's not. In order to establish a TLS connection, you'd have to do a revocation check. Can't perform that if you need a TLS connection to get the CRL. As far as the certificate, I'm guessing there are many, many checks as to the authenticity of the key before it ships. Plus, they'd have to use a cert from another CA, since theirs are not trusted yet. That's not elegant in a process that is used to start CAs.
mahouse 11y ago
It's normal, since their CA certificates aren't added to Firefox yet :-)
dlgeek 11y ago
The CRL part is according to the standard RFC 5280, Section 8 (Security Considerations): "CAs SHOULD NOT include URIs that specify https, ldaps, or similar schemes in extensions." (https://tools.ietf.org/html/rfc5280 https://tools.ietf.org/html/rfc5280, page 103)
- DanWaterworth 11y ago
  People having obscure knowledge never ceases to impress me. (It's page 104 though ;P )
  - lucb1e 11y ago
    I knew that as well because I was equally surprised that the revocation lists are over HTTP and looked this up, only I did this a few years ago. Not very obscure in my opinion.

Does it bother anyone else that the links Amazon provided to their certificates and CRLs are not https?

by aaronpk 11y ago

Does it bother anyone else that the links Amazon provided to their certificates and CRLs are not https?

The fingerprints are included in the bugzilla ticket and the CRLs are signed with the certificates, so TLS doesn't technically add anything as long as you confirm the fingerprints (though it doesn't hurt anything either).

aaronpk 11y ago
Yeah, it just seems odd
- qrmn 11y ago
  I don't think CRLs usually are, under current infrastructure anyway. How can you verify the certificate of the server when it's signed by the certificate you want to fetch; or check that it hasn't been revoked when what you're connecting to is its own CRL/OCSP? What about the risk of infinite loops? Cross-signatures, or multi-signatures, perhaps; or going opportunistic and simply not minding on that occasion? Nope, for now they just use HTTP, and pin what they need to, to the fingerprint. They should, however, specify an SHA-256 fingerprint. SHA-1 doesn't really cut it anymore. But that's what Mozilla currently require, so that's what Amazon provided. https://wiki.mozilla.org/CA:Information_checklist https://wiki.mozilla.org/CA:Information_checklist
- MichaelGG 11y ago
  No it's not. In order to establish a TLS connection, you'd have to do a revocation check. Can't perform that if you need a TLS connection to get the CRL. As far as the certificate, I'm guessing there are many, many checks as to the authenticity of the key before it ships. Plus, they'd have to use a cert from another CA, since theirs are not trusted yet. That's not elegant in a process that is used to start CAs.

mahouse 11y ago

It's normal, since their CA certificates aren't added to Firefox yet :-)

dlgeek 11y ago

The CRL part is according to the standard RFC 5280, Section 8 (Security Considerations): "CAs SHOULD NOT include URIs that specify https, ldaps, or similar schemes in extensions." (https://tools.ietf.org/html/rfc5280 https://tools.ietf.org/html/rfc5280, page 103)

DanWaterworth 11y ago
People having obscure knowledge never ceases to impress me. (It's page 104 though ;P )
- lucb1e 11y ago
  I knew that as well because I was equally surprised that the revocation lists are over HTTP and looked this up, only I did this a few years ago. Not very obscure in my opinion.