search

Lukasa / mkcert

Customised trust stores for you and your family.
Apache License 2.0
97 stars 15 forks source link

CKA_NSS_SERVER_DISTRUST_AFTER is not handled properly #19

Open AGWA opened 6 days ago

AGWA commented 6 days ago

When parsing certdata.txt, mkcert excludes roots whose CKA_NSS_SERVER_DISTRUST_AFTER time is after the current time.

This is incorrect behavior. CKA_NSS_SERVER_DISTRUST_AFTER is supposed to be compared against the leaf certificate's NotBefore time, not the current time:

If a builtin certificate has a CKA_NSS_SERVER_DISTRUST_AFTER timestamp before the SCT or NotBefore date of a certificate that builtin issued, then clients can elect not to trust it.

Source

See also https://bugzilla.mozilla.org/show_bug.cgi?id=1618404 and https://bugzilla.mozilla.org/show_bug.cgi?id=1621159

Mozilla intends to set the CKA_NSS_SERVER_DISTRUST_AFTER date of Entrust roots to November 30, 2024. mkcert's current behavior will cause consumers of mkcert to reject Entrust certificates that Firefox would have accepted, causing breakage that Mozilla did not intend.

Instead, mkcert should just ignore the CKA_NSS_SERVER_DISTRUST_AFTER date. Although this would cause consumers of mkcert to accept certificates that Firefox would have rejected, in practice this is not any less secure than Firefox. This is because roots with a CKA_NSS_SERVER_DISTRUST_AFTER date still have the ability to issue new certificates that are accepted by Firefox, by simply backdating the certificate's NotBefore date. The point of CKA_NSS_SERVER_DISTRUST_AFTER is not to provide security from an untrustworthy root, but to gracefully sunset trust in a root. When Mozilla adds CKA_NSS_SERVER_DISTRUST_AFTER to a root, they're not saying that certificates issued after that date are untrustworthy. Instead, they are saying that they would like to remove the root at some point in the future. Combined with enforcement of the 398 day maximum certificate lifetime, CKA_NSS_SERVER_DISTRUST_AFTER ensures that all certificates issued by a root are expired 398 days after the CKA_NSS_SERVER_DISTRUST_AFTER date, allowing for the root's removal without breakage. Consequentially, it is appropriate for mkcert to ignore CKA_NSS_SERVER_DISTRUST_AFTER and wait for Mozilla to fully remove the root.

alex commented 4 days ago

Thanks Andrew. https://github.com/Lukasa/mkcert/pull/20 should address this.

AGWA commented 4 days ago

Nice idea to exclude the root 398 days after the Distrust After!