Re: SSL/TLS - am I doing it right?


Sybren Stuvel wrote:
Frank Millman enlightened us with:
while 1:
conn,addr = s.accept()
c = TLSConnection(conn)
c.handshakeServer(certChain=certChain,privateKey=privateKey)
data = c.recv(1024)

It's nice that you set up a TLS connection, but you never check the
certificate of the other side for vality. You should make sure the
certificate chain is completely signed from top to bottom. Then check
that the bottom certificate is amongst trusted CAs. Also check all the
certificates in the chain against the CRL of the CA.

Thanks for the reply, Sybren.

I was hoping to avoid this step. The point of the exercise for me is
encryption. I am not too worried about authentication. The next step in
my app is for the client to enter a user id and password, and the
server will not proceed without verifying this.

However, I realise that security is not something to be trivialised, so
if your recommendation is that I do complete the validation steps, I
will try to understand that part of the documentation and apply that as
well.

Thanks

Frank

.

Relevant Pages

  • SA-20040802 GnuTLS certificate chain verification bug
    ... Mr. Hornik has discovered error in X.509 certificate chain ... verification procedure in GnuTLS library. ... certificate signatures signed with arbitrary RSA/DSA keys chosen by ...
    (Bugtraq)
  • Re: Vista Certificate Enrollment api
    ... Please follow these instructions to collect a log file. ... I'm using the new Certificate Enrollment API in Vista to enroll certificates ... is not surprising as the root of the certificate chain returned by the CA is ... I have verified that if I separately install the Root CA cert alone then the ...
    (microsoft.public.platformsdk.security)
  • Re: SChannel problems
    ... How to send only arbitrary list of trusted CA's to SSL client. ... How to build client certificate chain from SSL Content where initially ...
    (microsoft.public.platformsdk.security)
  • Re: [Full-Disclosure] PGP vs. certificate from Verisign
    ... DECIDING WHETHER OR NOT TO RELY ON THE INFORMATION IN A CERTIFICATE.? ... well as all the Certificates in its Certificate Chain. ... assurances, it is your responsibility to obtain such assurances for such ... You agree to release, indemnify, defend and hold harmless VeriSign and any ...
    (Full-Disclosure)
  • Outlook S/MIME Vulnerability
    ... Outlook's S/MIME implementation is vulnerable to the certificate chain ... The vulnerability allows anyone to forge the digital ... signature on an email that is to be viewed with Outlook. ...
    (Bugtraq)