677981 - CERT_PKIXVerifyCert does not allow a self-signed cert to be used as its own trust anchor

Status: NEW

(NSS :: Libraries, defect, P5)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: test program

Can't use a CERTValInParam of type cert_pi_trustAnchors to set a self-signed certificate as a trust anchor, then use CERT_PKIXVerifyCert to verify that certificate (for things like expiration, bad signature, etc.)
Results in SEC_ERROR_UNKNOWN_ISSUER.

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: Makefile

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: selfsigned.crt

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: selfsigned.c

fix typo

Comment 4

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: selfsigned.c

revocation flags need to be specified for CERT_PKIXVerifyCert to work ( -> updated selfsigned.c)

Comment 5

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: CERT_PKIXVerifyCert-selfsigned.patch

proposed patch (if the certificate is self-signed (i.e. a root), temporarily set the basic constraints criterion's minimum path length to -2, indicating that the certificate must be an end-entity certificate).

Comment 6

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: CERT_PKIXVerifyCert-selfsigned.patch

Better patch (previous one was not at all the way to do it).

Comment 7

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: CERT_PKIXVerifyCert-selfsigned.patch

Using pointer equality for certs. Also, switching out the minimum path length argument only needs to happen in one location, not the two from before.

Comment 8

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Comment on attachment 553617 [details] [diff] [review]
CERT_PKIXVerifyCert-selfsigned.patch

Clearing review. If this patch even still applies, there's a good chance we're not going to be using libpkix, so we don't even need it.

Comment 9

[Camilo Viecco (:cviecco)]

Keeler, we might still need libpkix for backwards compatibility. I would not throiw the effort away. However make sure you also check the certifiacte usages on the self signed case.