by jeff.allen:
TLS client authentication as implemented as of rev 10679
is not good enough for production use.
The server side cannot be instructed to require certs. It cannot be given a list of
roots to give to the client.
The client side does not choose certificates according to the
incoming trust list.
The marchalling/unmarshalling of the certificateRequest message is wrong, meaning that
it only works in the case where the server
elects to send no trust list.
What steps will reproduce the problem?
1. configure a lighttpd to require client certs signed by a certain CA:
$SERVER["socket"] == "0.0.0.0:443" {
ssl.engine = "enable"
ssl.verifyclient.activate = "enable"
ssl.verifyclient.enforce = "enable"
ssl.ca-file = "ca.pem" <-- cert of CA that signed the client cert
}
2. use get.go (attached) to try to fetch something, you will get a handshake error
What is the expected output?
Go's client certificate support should work.
What do you see instead?
Handshake error, and when the unmarshaler is fixed, the HTTPS client does not send the
cert due to the simple check for len(trust list)==0.
Which compiler are you using (5g, 6g, 8g, gccgo)?
6g and 8g
Which operating system are you using?
Linux
Which revision are you using? (hg identify)
10679
Attachments:
- get.go (596 bytes)
by jeff.allen:
TLS client authentication as implemented as of rev 10679 is not good enough for production use. The server side cannot be instructed to require certs. It cannot be given a list of roots to give to the client. The client side does not choose certificates according to the incoming trust list. The marchalling/unmarshalling of the certificateRequest message is wrong, meaning that it only works in the case where the server elects to send no trust list. What steps will reproduce the problem? 1. configure a lighttpd to require client certs signed by a certain CA: $SERVER["socket"] == "0.0.0.0:443" { ssl.engine = "enable" ssl.verifyclient.activate = "enable" ssl.verifyclient.enforce = "enable" ssl.ca-file = "ca.pem" <-- cert of CA that signed the client cert } 2. use get.go (attached) to try to fetch something, you will get a handshake error What is the expected output? Go's client certificate support should work. What do you see instead? Handshake error, and when the unmarshaler is fixed, the HTTPS client does not send the cert due to the simple check for len(trust list)==0. Which compiler are you using (5g, 6g, 8g, gccgo)? 6g and 8g Which operating system are you using? Linux Which revision are you using? (hg identify) 10679Attachments: