[Buildroot] [PATCH 1/3] package/mbedtls: add BR2_PACKAGE_MBEDTLS_X509_UNSUPPORTED_CRITICAL_EXTENSION
Yann E. MORIN
yann.morin.1998 at free.fr
Fri Apr 24 09:07:10 UTC 2020
Nicola, Fabrice, Thomas, All,
On 2020-04-24 01:27 +0200, Nicola Di Lieto spake thusly:
> On Thu, Apr 23, 2020 at 10:09:05PM +0200, Thomas Petazzoni wrote:
> >What is this X509_UNSUPPORTED_CRITICAL_EXTENSION functionality that is
> >so weird that it requires patching the mbedtls config.h file ? Why is
> >uacme absolutely requiring this functionality that no other user of
> >mbedtls requires ?
>
> There is an explanation at
> https://github.com/ndilieto/uacme/issues/23
>
> Briefly, tls-alpn-01 validation requires (as per RFC8737 section 6.1) a new
> critical certificate extension. mbedTLS doesn't know about it and refuses to
> parse any certificate with such extension unless that build feature is
> enabled.
So, I think I now wrapped my head around this issue, and I think I got
it. Here's what I understood from the different resources [0] [1]:
- in X.509, some extensions can be added to certificates
- an extension can be marked as 'critical' or 'not critical'
- an X.509 parser that encounters an extension marked 'critical' when
parsing a certificate, and that does not recognise that extension,
*must* reject that certificate.
mbedtls does the right thing here: it rejects such certificates.
However, embedtls has an option to treat thoe 'critical' extensions as
if they were 'not critical'.
I think we should refuse to use mbedtls with uacme.
[0] https://en.wikipedia.org/wiki/X.509
[1] https://github.com/ndilieto/uacme/issues/23
Regards,
Yann E. MORIN.
--
.-----------------.--------------------.------------------.--------------------.
| Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ |
| +33 561 099 427 `------------.-------: X AGAINST | \e/ There is no |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. |
'------------------------------^-------^------------------^--------------------'
More information about the buildroot
mailing list