fix: Improve certificate revocation checking #2626
Conversation
Configure PKIXRevocationChecker to only check end-entity certificates and use soft-fail for unavailable revocation information. This attempts to balance security and reliability: - Focusing revocation checks on leaf certificates, where revocation is most critical, avoiding issues with missing root certificate CRL distribution points - Preventing validation failures when OCSP/CRL servers are unreachable or when revocation information isn't available for some certificates - Avoiding common issues with intermediate/root certificate CRL checking
|
Can we make both options configurable please? That way, if Openfire is operating in a closed, tightly controlled network, an administrator can reconfigure that balance between security and reliability. I'm happy for this to be just a |
xmppserver/src/main/java/org/jivesoftware/openfire/keystore/OpenfireX509TrustManager.java
Show resolved
Hide resolved
Allow administrators to configure revocation checking behaviour. If Openfire is operating in a closed, tightly controlled network, an administrator can reconfigure the balance between security and reliability.
|
|
||
| // Only verify revocation status of end-entity (leaf) certificates if configured | ||
| // This avoids issues with chains where the root certificate isn't included | ||
| // in the chain (e.g. Let's Encrypt) and its CRL distribution point isn't accessible |
There was a problem hiding this comment.
This comment seems wrong.
The chain checked is presumably after path-building, so if the old Trust Anchor is not included in the peer chain, we'll have used our own copy anyway, surely?
(Exception being if DANE is in play, but then we possibly don't do CRL checking anyway, and Openfire doesn't yet do DANE).
Is there a better explanation of EE-only status checking?
There was a problem hiding this comment.
Thanks Dave, your comment led me to realise I hadn't understood what was going on.
Configure Java and BouncyCastle to enable CRL Distribution Points (CRLDP) checking. Openfire will now attempt to download CRLs from the URLs specified in the certificate's CRL Distribution Points extension, regardless of whether it's using BC or the Java built-in certificate validation.
Tightening up the default revocation checking config now that we can check revocation status of intermediate certificates via CRLDPs.
|
No, I think I've covered everything. |
|
Ok, thanks, I've unmarked it as draft, and have poked @dwd for a re-review (but shall hit the glowing green button if he does not in a timely manner, where 'timely' shall be interpreted in a completely subjective manner that likely is influenced by my intake of caffeine in the morning). |
Configure PKIXRevocationChecker to only check end-entity certificates and use soft-fail for unavailable revocation information.
This attempts to balance security and reliability: