<div class="socmaildefaultfont" dir="ltr" style="font-family:Arial, Helvetica, sans-serif;font-size:10pt" ><div dir="ltr" style="font-family:Arial, Helvetica, sans-serif;font-size:10pt" ><div dir="ltr" >Hello,</div>
<div dir="ltr" > </div>
<div dir="ltr" >thanks for the extensive answer.</div>
<div dir="ltr" > </div>
<div dir="ltr" >I will try to pursue a solution similar to your suggestion:</div>
<div dir="ltr" >- convert intermediate CA certificate to trusted certificate</div>
<div dir="ltr" >- validate client certificate using trusted certificate</div>
<div dir="ltr" > </div>
<div dir="ltr" >I still believe that addition of the new configuration option</div>
<div dir="ltr" >"ssl_verify_partial_chain" would benefit nginx because if</div>
<div dir="ltr" >we configure it using the "ssl_trusted_certificate" it doesn't</div>
<div dir="ltr" >send a list of allowed CAs to the client. We just can't cover</div>
<div dir="ltr" >the case when we want to send a list of allowed issuers</div>
<div dir="ltr" >(without their root certs) without changes to nginx.</div>
<div dir="ltr" > </div>
<div dir="ltr" > </div>
<div dir="ltr" >In my view, if I configure a certificate I1 as a trusted issuer, I should not be enforced</div>
<div dir="ltr" >to add its issuer to list of trusted certificates. I would like to tell my server to trust all</div>
<div dir="ltr" >certificates issued by <span style="font-size: 10pt;" >certificate I1 (and not by it's root issuer). Similar functionality</span></div>
<div dir="ltr" ><span style="font-size: 10pt;" >is available in some other products I used and </span><span style="font-size: 10pt;" >it seems natural to me but people</span></div>
<div dir="ltr" ><span style="font-size: 10pt;" >with different background can (of course) disagree.</span></div>
<div dir="ltr" > </div>
<div dir="ltr" >---</div>
<div dir="ltr" >Use Case 1 for such an approach:</div>
<div dir="ltr" >For example, we could even have the following hierarchy of certificates:</div>
<div dir="ltr" >- R (root CA)</div>
<div dir="ltr" > - L0n (client leaf cert 00, 01,..)</div>
<div dir="ltr" > - I1 (intermediate CA)</div>
<div dir="ltr" > - L1n (client leaf cert 10, 11)</div>
<div dir="ltr" > - I2 (intermediate CA)</div>
<div dir="ltr" > - L2n (client leaf cert 20, 21,..)</div>
<div dir="ltr" > </div>
<div dir="ltr" >We would want to trust certs issued by intermediate CA I1 but not trust</div>
<div dir="ltr" >certs L0n or L2n.</div>
<div dir="ltr" > </div>
<div dir="ltr" >Without the possibility to trust only the I1 and not the R we can't make sure</div>
<div dir="ltr" >that someone won't call us with L0n certs.</div>
<div dir="ltr" > </div>
<div dir="ltr" >---</div>
<div dir="ltr" ><div>Use Case 2 for such an approach (a real use case):</div>On a more practical note, we need to trust all certs issued by any of the</div>
<div dir="ltr" >issuer certs from the EU trusted certificates list site and root certs are</div>
<div dir="ltr" >not published there.</div>
<div dir="ltr" > </div>
<div dir="ltr" > </div>
<div dir="ltr" > </div>
<div dir="ltr" > </div>
<div class="mail-signature-container" dir="ltr" >Kind regards<br><b><font color="#555555" size="2" >Vedran Vidovic</font></b></div>
<div dir="ltr" > </div>
<div dir="ltr" > </div>
<blockquote data-history-content-modified="1" data-history-expanded="1" dir="ltr" style="border-left:solid #aaaaaa 2px; margin-left:5px; padding-left:5px; direction:ltr; margin-right:0px" >----- Original message -----<br>From: "Maxim Dounin" <mdounin@mdounin.ru><br>To: nginx-devel@nginx.org<br>Cc:<br>Subject: Re: ssl_verify_partial_chain<br>Date: Thu, May 19, 2022 4:25 AM<br>
<div><font face="Default Monospace,Courier New,Courier,monospace" size="2" >Hello!<br><br>On Wed, May 18, 2022 at 02:28:28PM +0200, Vedran Vidovic wrote:<br><br>> We would like to be able to configure the mutual TLS client<br>> authentication by:<br>> - adding intermediate CA certificates<br>> - without adding the root CA certificate for each intermediate<br>> certificate<br>><br>> If we add CA as a trusted issuer, we shouldn't need to add its issuer<br>> to<br>> the truststore (ssl_client_certificate).<br>><br>> I propose a backward compatible solution to add a new configuration<br>> option ssl_verify_partial_chain that can be turned on if the behaviour<br>> described above is desired. This option enables the openssl library<br>> partial_chain verification.<br><br>(First of all, just to make sure it's understood and this isn't<br>something you are trying to do. Note that if one want to limit<br>access, it might be a good idea to use some actual authorization<br>checks in additional to PKI, which essentially provides<br>authentication. Using narrow trust as a poor man's authorization<br>checks is not the way to go.)<br><br>After reading <a href="https://github.com/openssl/openssl/issues/7871" target="_blank" >https://github.com/openssl/openssl/issues/7871</a> I<br>tend to think that a better solution might be to explicitly<br>configure trust on the certificates if such configuration is<br>needed.<br><br>Something like:<br><br>$ openssl x509 -in cert.pem -out trust.pem -trustout -addtrust anyExtendedKeyUsage<br><br>will do the trick.<br><br>For ssl_trusted_certificate / proxy_ssl_trusted_certificate this<br>works out of the box (seems to work at least since OpenSSL 1.0.2,<br>the same version where X509_V_FLAG_PARTIAL_CHAIN was introduced).<br><br>For ssl_client_certificate it needs some additional cert in the<br>file to work, as SSL_load_client_CA_file() is not able to parse<br>certificates with trust data. (And such certificates won't be<br>advertized during SSL handshakes.) Not sure if it's practical<br>problem, but if it is, it should be possible to adjust<br>SSL_load_client_CA_file() and/or switch to a different way to<br>create the CA list for SSL_CTX_set_client_CA_list().<br><br>[...]<br><br>> @@ -874,6 +874,25 @@<br>> <br>> SSL_CTX_set_verify_depth(ssl->ctx, depth);<br>> <br>> + if (partial_chain == 1) {<br>> + X509_VERIFY_PARAM *param = X509_VERIFY_PARAM_new();;<br>> + if (param) {<br>> + X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_PARTIAL_CHAIN);<br>> + if (SSL_CTX_set1_param(ssl->ctx, param) == 0) {<br><br>Just in case, setting flags via X509_STORE_set_flags(), much like<br>ngx_ssl_crl() does, should be much easier.<br><br>--<br>Maxim Dounin<br><a href="http://mdounin.ru/" target="_blank" >http://mdounin.ru/</a><br>_______________________________________________<br>nginx-devel mailing list -- nginx-devel@nginx.org<br>To unsubscribe send an email to nginx-devel-leave@nginx.org</font></div></blockquote>
<div dir="ltr" > </div></div></div><font face="sans-serif"><br><br><a href="https://croz.net/uvjeti-iznimke-prijenosa-informacija">Odricanje od odgovornosti - disclaimer</a>
</font>