mailing list archives
X.509 name constraints and potential interpretation conflict
From: Florian Weimer <fweimer () redhat com>
Date: Mon, 12 Aug 2013 15:05:48 +0200
NSS CA roots are widely reused, but the implementation deviates from RFC
5280 in such a way that NSS can safely accept additional root
certificates as long as they have name constraints. I think this is a
bug in RFC 5280, and the fix in NSS is sound, but it could still result
in surprising behavior if the root store is used unfiltered with TLS
implementations that lack this bug fix.
For reference, here is the RFC 5280 errata I submitted:
Reported by: Florian Weimer <fweimer () redhat com>
DNS name restrictions are expressed as host.example.com. Any DNS
name that can be constructed by simply adding zero or more labels to
the left-hand side of the name satisfies the name constraint. For
example, www.host.example.com would satisfy the constraint but
host1.example.com would not.
[Add this to the paragraph]
If an implementation extracts DNS names from the subject
distinguished name, DNS name restrictions MUST be applied
to these names as well.
When used with TLS and HTTP (according to RFC 2818), section 188.8.131.52,
Name Constraints, is technically a NOP that doesn't constraint the CA
that has this attribute because RFC 2818 mandates processing of the
common name attribute in the subject distinguished name.
Consequentially, the constraint can be bypassed by issuing a certificate
without a subject alternative name. The fix is to apply the DNS name
restrictions to the relevant parts of the subject distinguished name,
too, as implemented here:
Florian Weimer / Red Hat Product Security Team
- X.509 name constraints and potential interpretation conflict Florian Weimer (Aug 12)