657236 - Session ticket may not contain enough of the client cert chain to reconstruct it during resumption

Status: RESOLVED INVALID

(NSS :: Libraries, defect, P5)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

The server side of libssl includes the client EE certificate (if there is one), but it doesn't include any intermediaries. That means the server may not be able to reconstruct the client's cert chain in a resumed session. (Whether or not this is useful or necessary depends on the application.)

Comment 1

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

See also Bug 657237 comment 0.

Comment 2

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

If the whole client cert chain were to be included in the session ticket, it would be more likely that the session ticket would become too large to fit inside the client hello extension. If/when we fix this bug (and, really, even if we don't), we should make sure that we never try to send a NewSessionTicket message with a session ticket larger larger than (2^16 - 1) bytes.