Open santiagorodriguez96 opened 10 months ago
This seems to be caused by the way we validate our certificate chain – essentially:
store = OpenSSL::X509::Store.new
root_certificates.each do |root_certificate|
store.add_cert(root_certificate)
end
attestation_certificate = attestation_trust_path.first
store.verify(attestation_certificate, attestation_trust_path)
For this spec, the root certificate – present in the attestationRootCertificates
attribute in the authenticator's Metadata Statement – is:
On the other hand, the attestation_trust_path
– which comes from the x5c
attribute of the attestation statement – for this spec is the following:
Note that the last certificate in the attestation_trust_path
is the root certificate itself. According to this spec, this chain is invalid because concatenating the attestation_trust_path
with the root_certificates
results in the chain having duplicate certs, which is invalid according to the RFC 5280:
A certificate MUST NOT appear more than once in a prospective certification path.
However, the chain is in fact valid to OpenSSL
given that, if I understand correctly, it stops building the chain when it finds a self-signed certificate – as stated in the docs:
When a self-signed certificate has been added, chain construction stops. In this case it must fully match a trust anchor, otherwise chain building fails.
Hence our code treats such attestation_trust_path
as valid.
I'm not sure about which approach is correct here to be honest. The following paragraph from the RFC 5280 states that self-signed certificates should not be included in the certification path:
When the trust anchor is provided in the form of a self-signed certificate, this self-signed certificate is not included as part of the prospective certification path. Information about trust anchors is provided as inputs to the certification path validation algorithm (Section 6.1.1). [source]
Not sure how to proceed with this.
How to run FIDO2 conformance tests: https://github.com/cedarcode/webauthn-ruby/tree/master/spec/conformance.