search

Cloud-Foundations / keymaster

Short term certificate based identity system (ssh/x509 ca + openidc)
Apache License 2.0
124 stars 15 forks source link

Generate Keymaster CA to be used as client only certificates #144

Open bjhaid opened 2 years ago

bjhaid commented 2 years ago

This will allow distributing the CA certificate to machines for trust and not worry about the certificate trusting servers. The certificate should probably have only the ExtKeyUsageClientAuth bit set

cviecco commented 2 years ago

Do you mean keymaster's CA cert as dowloaded from https://keymaster.example.com/public/x509ca. I dont understand te question (why would clients want this cert anyway?). Or if its something else can you explain an provide steps for reproducing?

rgooch commented 2 years ago

@bjhaid Ping?

bjhaid commented 2 years ago

I dont understand te question (why would clients want this cert anyway?).

This certs need to be trusted on the clients machine to prevent the continuous prompts to manually trust the certificate. To prevent the CA from being used to issue a server cert that can MITM the user's traffic, the CA needs to explicitly indicate it is only used for signing clients certs and nothing more. As it is today the CA can be used to sign both server and client certificates.

cviecco commented 2 years ago

@bjhaid what OS/browser combination are you seeing? The expected behavior (when using a browser) is:

  1. The browser connects to the server and in the TLS handshake asks for an optional client side certificate. The server side certificate should be signed by a trusted authority.
  2. There should not be a need to inject the keymasterCA to users's browser, it should only be needed by servers that want to trust keymaster x509 certificates for clients (and while we could add the needed x509 flags) I am confused by the ask.
  3. The clients should try to NOT use the optional cert (but chrome does not do this, instead is asks if there is any cert client want to use, and users should cancel/ignore this). After this no more client interaction is expected.

Can you detail here the behaviour you are seeing? and what are you expecting?

bjhaid commented 2 years ago

the behavior I am seeing is:

  1. browser asks me for client cert to present to server as below(issuer and serial intentionally grayed out) :
Screen Shot 2022-03-16 at 2 17 14 PM
  1. I get the prompt in asking to trust as in the screenshot Screen Shot 2022-03-16 at 2 11 44 PM

    That prompt shows up 4-5 times

When I had not trusted the server's CA I would get prompt number 2 every time I tried logging into keymaster/cloudgate. To prevent that from happening, rather than requiring every user to manually trust the cert we can instead distribute it to the users.