From owner-freebsd-current@freebsd.org Sun Mar 15 00:31:08 2020 Return-Path: Delivered-To: freebsd-current@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 865402684FF for ; Sun, 15 Mar 2020 00:31:08 +0000 (UTC) (envelope-from rmacklem@uoguelph.ca) Received: from CAN01-TO1-obe.outbound.protection.outlook.com (mail-eopbgr670049.outbound.protection.outlook.com [40.107.67.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mail.protection.outlook.com", Issuer "GlobalSign Organization Validation CA - SHA256 - G3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 48g0j62r7vz4bmK for ; Sun, 15 Mar 2020 00:31:05 +0000 (UTC) (envelope-from rmacklem@uoguelph.ca) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=c1WgUQoMTI/mKYJIDx2NEiKKuDSe38fR6UgLniMG+VJq23DK+If5U8sluTQMXdscc4ILqwN4b+NC1Oaoxb/lQiUlZYA8pDG6iC2oXPfuWzdurezpeKusDXGOQuTiD4BujN3eQbkUZ0jnQP89i02j5OZeG2z+zoeS3eXEgDl4MKqSOi6r067ZxnKmuiSE+tKkKeMq9CQeTEuPtvMtQlaeUUycHsGaqBROntENwA+s5dKyjDoE9riTOfjXnmoNqs7h6OOCmE78aSQfUiKxh36il4+3ZY7zw+EHR1TxpGC8qZiOshVMYEzh94wOPPXqEHPLxsc1HOUKNOS5NXdEk2M7+Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=DqCB+PpT8YtKgMlyC3P9gDOzEpCfL/0AadPeZdTOymI=; b=OW1sgjH5+qnvR0pgb9o7Eyic4FqcuW7oMQV9E3P99d5xtV/a9cLsnQONbrsOXARa9niph6MX3TuLSpUi+8ToWDgB3Yu5kyGZZuA7OOXXSFXwnsDCCQR94PJqXjqGICwY/pCpcjOguDbiqt1US9zHw/fuUgh6i82hyjchR07nl8WDWHBPx+Gb77rI4XDaMq4xYFxuzqMgthGB7w826gARKlGYfQyjqaiXS+TeuFNBtljLYY1ngkX/MLc4GZoHJ5pRBBArUn+/MfqYGkKdmrcTkw/XPUeD+owd7mSlZTkjkvo6FwpjtlF2ApRk5WhfY29M+clcJ7sZPmUNo1tbxzJu9A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=uoguelph.ca; dmarc=pass action=none header.from=uoguelph.ca; dkim=pass header.d=uoguelph.ca; arc=none Received: from YTBPR01MB3374.CANPRD01.PROD.OUTLOOK.COM (10.255.46.82) by YTBPR01MB2351.CANPRD01.PROD.OUTLOOK.COM (10.255.46.88) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2814.19; Sun, 15 Mar 2020 00:31:03 +0000 Received: from YTBPR01MB3374.CANPRD01.PROD.OUTLOOK.COM ([fe80::a50d:6237:4074:f9c4]) by YTBPR01MB3374.CANPRD01.PROD.OUTLOOK.COM ([fe80::a50d:6237:4074:f9c4%6]) with mapi id 15.20.2814.018; Sun, 15 Mar 2020 00:31:03 +0000 From: Rick Macklem To: Garrett Wollman CC: "freebsd-current@FreeBSD.org" Subject: Re: when does a server need to use SSL_CTX_set_client_CA_list()? Thread-Topic: when does a server need to use SSL_CTX_set_client_CA_list()? Thread-Index: AQHV+Z9BqmBxwqP+PUqf7mEWx47LjahHfK6AgAFOxSQ= Date: Sun, 15 Mar 2020 00:31:03 +0000 Message-ID: References: , <202003140420.02E4Kx4q055789@hergotha.csail.mit.edu> In-Reply-To: <202003140420.02E4Kx4q055789@hergotha.csail.mit.edu> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 80212905-454b-4fbc-ef3b-08d7c87824f6 x-ms-traffictypediagnostic: YTBPR01MB2351: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0343AC1D30 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(346002)(366004)(136003)(39860400002)(396003)(199004)(66476007)(66946007)(8676002)(76116006)(64756008)(66446008)(66556008)(186003)(33656002)(81156014)(71200400001)(8936002)(786003)(4326008)(81166006)(316002)(9686003)(478600001)(6916009)(5660300002)(55016002)(2906002)(52536014)(7696005)(6506007)(86362001); DIR:OUT; SFP:1101; SCL:1; SRVR:YTBPR01MB2351; H:YTBPR01MB3374.CANPRD01.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; received-spf: None (protection.outlook.com: uoguelph.ca does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: v3s6OIZqXWqMJOPmaQ/DlFU5W96ahO7Xijivup5EqEdM97fEr0IRd9IihLzALpf5otmsgUgXP+/E2UdXujM5UkiKNM2sbKgo0oPcc5940BNC8DKARokm2R2wL95BOu8+fftELGs7NjRf8yryw5Yp+MFdCLC1C0JjHkeZv1PsOLFNKTqrQvNSkmINErda4PKbPvwHCG7qtZ3drz+mQi2qnwQUW7p/84coAcLNIVQYW75wCs5fFW9I8th35O2ec+3EaOpSWtjfa9K3H/Uzkfxsuj1s9zsIOF1Crjgm7ab5pox4L9cG6lXSFQiuw9MjWZeRyD6kz8aK0rkCfF7WciNjHOoQJhgigj7uaBCTfU9TPmFuCvXnCGhc42/6g1r5eB5Sci8oVNKloof5oBhvL+repn/wkzTLK8lV4jcuGqam/jx7MuFyJ7ZRc1qOscQsGHBX x-ms-exchange-antispam-messagedata: R7+SHOKefSFYH8gkAknBMmgeNK7KbN9pOLEHPJuW99QsbxDFhNbewqO+2vRrvEutO6IcUX0m0Mc1K9NWopfNPkdsaGO4EYXR4x+aUjTUxBA01YgSH/NeA3E3PR0vWgWhQvpKZ4jek28omaiI69AoDfqK2pRtpKwOILIo2/eMaTjeJDn3HKI71oj6aEmxtgjMdEVSy4Dw8ixYEVEZsVoI9A== x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: uoguelph.ca X-MS-Exchange-CrossTenant-Network-Message-Id: 80212905-454b-4fbc-ef3b-08d7c87824f6 X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Mar 2020 00:31:03.7008 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: be62a12b-2cad-49a1-a5fa-85f4f3156a7d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 53UdZ31xFWgQAvaGv2+6dz1EcPWoNDXN1Yom6JsOIJfG4Czne3AilURXDb8PtC1rabokt6DTQB46GMeyJJtBHQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: YTBPR01MB2351 X-Rspamd-Queue-Id: 48g0j62r7vz4bmK X-Spamd-Bar: --- Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=none; spf=pass (mx1.freebsd.org: domain of rmacklem@uoguelph.ca designates 40.107.67.49 as permitted sender) smtp.mailfrom=rmacklem@uoguelph.ca X-Spamd-Result: default: False [-3.67 / 15.00]; TO_DN_EQ_ADDR_SOME(0.00)[]; NEURAL_HAM_MEDIUM(-0.99)[-0.986,0]; FROM_HAS_DN(0.00)[]; TO_DN_SOME(0.00)[]; R_SPF_ALLOW(-0.20)[+ip4:40.107.0.0/16]; NEURAL_HAM_LONG(-1.00)[-1.000,0]; MIME_GOOD(-0.10)[text/plain]; RCVD_TLS_LAST(0.00)[]; DMARC_NA(0.00)[uoguelph.ca]; RCVD_COUNT_THREE(0.00)[3]; TO_MATCH_ENVRCPT_SOME(0.00)[]; RCPT_COUNT_TWO(0.00)[2]; RCVD_IN_DNSWL_NONE(0.00)[49.67.107.40.list.dnswl.org : 127.0.3.0]; IP_SCORE(-1.39)[ipnet: 40.64.0.0/10(-3.77), asn: 8075(-3.10), country: US(-0.05)]; FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+]; R_DKIM_NA(0.00)[]; ASN(0.00)[asn:8075, ipnet:40.64.0.0/10, country:US]; SUBJECT_ENDS_QUESTION(1.00)[]; ARC_ALLOW(-1.00)[i=1] X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 15 Mar 2020 00:31:08 -0000 Garrett Wollman wrote:=0A= >Rick Macklem writes:=0A= >>Since it is done in sample code, I have an option in the RPC-over-TLS=0A= >>server daemon that does the SSL_CTX_set_client_CA_list() call.=0A= >>When I test, I have not used this option and the code seems to work.=0A= >>Maybe this is because the client only has a single certificate?=0A= >=0A= >In general, the server needs to send a list of CAs that it's willing=0A= >to accept for client certificate use, because the server should never=0A= >accept just any old CA; normally, a client will interpret receiving=0A= >the list as a request to send a client certificate issued by one of=0A= >the indicated CAs, but the client can send its certificate even if the=0A= >server doesn't send the list or even if the server sends a list but=0A= >client certificate isn't issued by a CA on the list.=0A= >=0A= >It's probably a good idea to send the list even if there's only a=0A= >single valid CA, configured by prior agreement; the overhead is=0A= >minimal and it gives an indication to a fussy or confused client what=0A= >is being required of it.=0A= Ok, so does SSL_CTX_load_verify_locations() set up the server to verify=0A= the certificates and SSL_CTX_set_client_CA_list() set the list of certifica= te=0A= names sent to the client?=0A= =0A= Put another way, should the server normally:=0A= SSL_CTX_load_verify_locations(ctx, cafile, NULL);=0A= and=0A= SSL_CTX_set_client_CA_list(SSL_CTX_load_client_CA_file(cafile));=0A= where cafile is the file with the CA certificates in it?=0A= =0A= I currently have the server setting these via separate options and only do = the=0A= first one.=0A= If they both use the same file, then I can simplify things and get rid of o= ne of=0A= the options.=0A= =0A= Thanks for your help with this, rick=0A= =0A= >My recollection is that in the OpenSSL API in particular, if you don't=0A= >set an explicit client CA list, but you *do* set a CA bundle or=0A= >directory to automatically construct the *server's* trust path, then=0A= >the library will just send the name of every single CA it knows about.=0A= =0A= -GAWollman=0A= =0A=