|
|
A certificate is defined as a client certificate if it contains an "Email" field in the CN. AFAIK all CAcert client certificates either include one of the verified email addresses or the "Single Sign On ID Information" in the Email field. |
|
|
Created branch bug-1149 on https://github.com/CAcertOrg/cats.git |
|
|
Merged the branch into testserver branch |
|
|
Tested with this procedure: - Create key and CSR with: openssl req -newkey rsa:2048 -keyout test.key -subj "/CN=dummy.convey-ag.de" -out test.csr - Created certificate with testserver, stored into test.crt - Created importable PKCS12 file with: openssl pkcs12 -export -out test.p12 -inkey test.key -in test.crt -name "Test Certificate for CAcert bug-1149" - Firefox 41.0.2 refused to import the certificate with unspecific error message - Importing into Windows Certificate Storage: - open MMC.EXE and add plugin "Certificates" for current user - Goto "Own Certificates" and use right click -> All Tasks... -> Import - Import the test.p12 file - "dummy.convey-ag.de" certificate shows in "Own Certificates -> Certifictes" - Open Internet Explorer for https://cats1.it-sls.de:14843 - When asked by Internet Explorer, select the imported certificate ("Test Certificate for CAcert bug-1149") for authentication - Click "Login" ==> Error message is shown: Your certificate does not contain an Email field, you are probably using a server certificate. Server certificates cannot be used to log in to CATS since they do not identify a person. ==> Correct behaviour for this kind of certififcates. Please test also with your own browser. I added the test.p12 file (password for import is "test"), just in case you don't have the time to create your own certificate... |
|
|
Login works with my "usual" client certificate. Additional tests needed for other types of allowed certificates: - "Anonymous" certificates - Certifictes with only Single Sign On ID - Certificate with multiple emails |
|
|
I tested with a new created server certificate from the test server which I imported via mmc to the windows truststore. With Chrome I was able to connect to the cats1 but this error message is shown: Your certificate does not contain an Email field, you are probably using a server certificate. Server certificates cannot be used to log in to CATS since they do not identify a person. => ok With a client certificate the login worked perfectly. =>ok =>ok |
|
|
Using Ted's openssl commands - Create key and CSR - Created certificate with testserver - Created importable PKCS12 file - Import to Iceweasel 41.0.2 - Open Iceweasel 41.0.2 for https://cats1.it-sls.de:14843 [^] - When asked by Iceweasel, select the imported certificate ("Test Certificate for CAcert bug-1149") for authentication - Click "Login" ==>Show Error Your certificate does not contain an Email field, you are probably using a server certificate. Server certificates cannot be used to log in to CATS since they do not identify a person. =>OK With a client certificate with email Address, login worked perfectly. =>OK OK |
|
|
-Using user paul.panter@pink.org at testsystem -Created Server certificate for www.looney.org -Imported certificate into user-certificate-store -Started EDGE -Start https://cats1.it-sls.de:14843/ -Site was displayed => OK => There was client certificates only listed for auth-seletion. => OK Login with client certificate was possible without errors => OK |
|
|
-Using user paul.panter@pink.org at testsystem -Created Server certificate for www.looney.org -Started Firefox -Imported certificate into firefox 42 -Start https://cats1.it-sls.de:14843/ [^] -Site was displayed => OK => Your certificate does not contain an Email field, you are probably using a server certificate. Server certificates cannot be used to log in to CATS since they do not identify a person. => OK Login with client certificate was possible without errors => OK |
|
|
Three people did four tests. Has the fix been implemented? |
|
|
https://github.com/CAcertOrg/cats/tree/bug-1149 has never been merged. I don't know who is responsible for the CATS code. |
|
|
Tested with: EDGE: no server cert is displayed in the cert list, after click on "Login" Tested with Firefox (has own cert repo): the cert is requested before the login page is displayed; and after selection the server cert this error is displayed on the login page: (see the attachment). CATS-deny.gif (3,740 bytes) |
|
|
This is an issue caused by the CAcert CA certificate structure and the way TLS client certificate authentication works. Client certificate authentication is initiated during the TLS handshake. The server sends a list of acceptable CA certificates. Because our client and server certificates are signed by the same CA certificates/keys the client/browser can send either a client or a server certificate. Another issue is that the server certificates issued by CAcert contain the following Extended Key Usage extension values: X509v3 Extended Key Usage: TLS Web Client Authentication, TLS Web Server Authentication, Netscape Server Gated Crypto, Microsoft Server Gated Crypto Due to these extensions the server certificates are valid client certificates too. This makes it impossible for a client to know that this might not be fit for the purpose auf authenticating a user. In the mid/long-term we should switch to a proper CA certificate structure that supports this better: Root CA should only sign subordinate CA (Sub CA) certificates - separate Sub CA for personal client certificates (issued for names and email addresses) - separate Sub CA for machine client certificates (issued for hostnames) - separate Sub CA for server certificates (issued for hostnames) Server applications could say that they only accept client certificates from the personal client certificate Sub CA, if the CA certificates would have this, or a similar structure. There is no proper solution for this issue without changing the CA certificate structure. The error message in the screenshot that @alkas shared is just a workaround to help users know what is wrong. |
- Anonymous
