WebApp Sec: Re: How to perform SSL certificate validation ?

["Nagareshwar Talekar" <tnagareshwar () gmail com>]

Hi List,

     Thank you for the information. It was very useful especially the
BIG detailed mail
by Kevin. I think it can make up a  good article on ssl validation
process..( as there is not much info on this currently on net )

  I forgot to mention that I am implementing it in C/C++ on windows platform.

  I read one of the ssl_mitm pdf and tried to create a self signed
certificate using SSL as mentioned in it. To my surprise I found that
user can specify all the parameters while creating the certificate and
hence attacker can create fully valid certificate.....which can defeat
the major checks such as

1) Date validation
2) Hostname checks
3) Even one can put trusted CA's name (Verisign Inc etc).which can
   make it to believe that this is from trusted authority.

I think these are the major checks done by browser such as IE ,
firefox etc....!!!
( One can make out from the dialogs shown by these browsers )

Am I into wrong conclusions? Any comments ?


Also I have got simple idea of checking for trusted certificate ( since
we don't want to cache the trusted root certificates as browsers do )
Here it is
1) During first time connection with server , if its certificate is valid
( i.e date is valid and hostname matches ) then it will be added to the local
cache.

2) During next connection with that server, incoming certificate will be checked
against the cached certificate ( in addition to date check) , if its not same
then that means the certificate is not trusted..

It looks simple and straight forward. Do you see any flaw in this
implementation ??


Thanks for your time..!

-------------------------------------------------------------------------
Sponsored by: Watchfire

Cross-Site Scripting (XSS) is one of the most common application-level 
attacks that hackers use to sneak into web applications today. This 
whitepaper will discuss how traditional CSS attacks are performed, how to 
secure your site against these attacks and check if your site is protected. 
Cross-Site Scripting Explained - Download this whitepaper today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmr
--------------------------------------------------------------------------