Browse Source

tls/client auth: verify first certificates in client request (#3344)

When client certificate is enabled Caddy check only last certificate from
request. When this cert is not in list of trusted leaf certificates,
connection is rejected. According to RFC TLS1.x the sender's certificate
must come first in the list.  Each following certificate must directly
certify the one preceding it.

This patch fix this problem - first certificate is checked instead of last.
master
Karol Będkowski 5 years ago
committed by GitHub
parent
commit
b814c0af9c
No known key found for this signature in database GPG Key ID: 4AEE18F83AFDEB23
  1. 2
      modules/caddytls/connpolicy.go

2
modules/caddytls/connpolicy.go

@ -395,7 +395,7 @@ func (clientauth ClientAuthentication) verifyPeerCertificate(rawCerts [][]byte,
return fmt.Errorf("no client certificate provided")
}
remoteLeafCert, err := x509.ParseCertificate(rawCerts[len(rawCerts)-1])
remoteLeafCert, err := x509.ParseCertificate(rawCerts[0])
if err != nil {
return fmt.Errorf("can't parse the given certificate: %s", err.Error())
}

Loading…
Cancel
Save