We will continue talking about certificate extensions from Reddit. openssl s_client -connect reddit.com:443 </dev/null | openssl x509 -text -noout
Authority Information Access ( AIA )
This extension offers two pieces of information: – On-line register to check certificate validity. – Site to download CA issuer certificate.
Both OCSP and "CA Issuers" are using HTTP ( not HTTPS ). They only contain public data and are signed ( integrity is protected ).
OCSP
OCSP ( On-line Certificate Status Protocol ) is online white list of valid certificates. When the client receives the certificate, the client will read OCSP web site address from that certificate. The client will send serial number of a certificate and public key hash to that web site, and it will get an answer whether the certificate is valid. The answer can be: good, revoked or unknown.
OCSP vs CRL ( Certificate Revocation List )
OCSP has two major advantages over CRL.
1) The size of CRL file is in MB, OCSP traffic is in KB.
2) OCSP lists are updated more often.
Unfortunately, OCSP has two drawbacks:
1) If OCSP service is down, it is not possible to verify a certificate. In that case, most internet browser will ignore OCSP if it is not available.
2) OCSP is now informed about each web site the client visited. That is a compromise of privacy.
OCSP vs OCSP Stapling
Instead of OCSP, modern browsers use OCSP stapling. This is how OCSP stapling works. Every few hours, the server will download a signed confirmation from a certificate authority that the server's certificate is valid. That confirmation is time stamped and has a limited lifespan. Now the server has proof that its certificate is valid.
During TLS handshake between the server and client, the server will give the client its certificate, and signed confirmation. We can think of OCSP confirmation stapled to a certificate. Client can now trust the server's certificate.
These are the benefits of OCSP stapling:
1) CA can not monitor what web addresses the client is visiting. The privacy is preserved.
2) Less of internet traffic and less burden on OCSP server.
3) It is not a problem if OCSP stapling service is down. The server can cache OCSP stapling, so everything works until OCSP stapling service is up again.
Modern browsers will try OCSP Stapling, if that fails, they will try OCSP, and as a last resort they will try CRL.
CA Issuers
According to CRT extension, this link certainly contains a certificate.
We will download that certificate with WGET command.
cd /home/fff/Desktop wget http://cacerts.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crt
This is DER certificate. We can read its content.
openssl x509 -in DigiCertGlobalG2TLSRSASHA2562020CA1-1.crt -inform DER -text -noout
Inside of this certificate we will see familiar numbers. Based on them we know that this is intermediate certificate.
To verify a server certificate, a client must have the entire certificate chain, from the root CA certificate to the leaf certificate. However, misconfigured web servers often forget to include intermediate certificates, sending only their own end-entity certificate. In this case, we can use the CA certificate issuer link to follow the certificate chain upstream and complete the entire certificate chain. This is known as AIA Chaining.
How to Use OCSP for Manual Check?
We already know that OCSP link is "http://ocsp.digicert.com". We can get it separately like this: openssl s_client -connect reddit.com:443 </dev/null | openssl x509 -noout -extauthorityInfoAccess
We already have intermediate certificate ( from AIA link ↑ ). I will download the leaf certificate. openssl s_client -connect reddit.com:443 </dev/null | openssl x509 -out LeafCert.crt
Now that we have both certificate ( leaf and intermediate ), and we know OCSP link, we can use ocsp command. openssl ocsp -issuer DigiCertGlobalG2TLSRSASHA2562020CA1-1.crt -cert LeafCert.crt -url http://ocsp.digicert.com
This will be the result. According to OCSP response, our certificate has status good. This answer will be valid for 7 days.
How to Check if CA Supports OCSP Stapling?
We will read Reddit.com certificate. We will use option "-status".
If we get a response that contains this block of data, that means that our CA supports OCSP stapling.
Basic Constraint
For Reddit, this extension is FALSE. That means that this certificate can not be used to validate other certificates. Only certificates of Certification Authorities have this extension set to TRUE.
We can read this extension from intermediate certificate. For DigiCert, this extension is set to TRUE. openssl x509 -in http://cacerts.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crt -noout -extbasicConstraints
We can also notice that there is "pathlen" property for DigiCert basic constraint. If the value for "pathlen" is 0, that means that below this certificate there can be zero intermediate certificates. This value shows how many intermediate certificates can be below DigiCert certificate.
On the image we can see that this limit makes impossible for someone to prolong certificate chain. Without this setting, anyone would be able to use legitim certificate to sign fake certificates.
This extension is always labeled as "critical". A client must obey this extension. If a client doesn't understand this extension, then it must reject connection with a server.
CT Precertificate SCTs
Certificate Authorities can be hacked or they can make a mistake. CAs can be coerced by the local government. This can lead to CA creating fake certificates for important web sites. For example, a new certificate can be created for a fraudulent bank web site. When a client access that web site, a client will not know that it is a rogue web site. That web site can now steal the client's password.
Solution is to monitor creation of the new certificates. These days every new certificate must be registered on online lists that are known as "Certificate Transparency logs". CA will create uncomplete certificate "Precertificate" (1). The precertificate will be send to CT (2). CT will create final certificate (3). Final certificate will have "CTPrecertificateSCTs" (4) extension. Thanks to that extension, certificate now has a proof that it is registered in CT logs. Now it is possible to check whether someone issued an illegal certificate for the web site we own. This is done by searching for a web site name on CT logs.
SCT is "Signed Certificate Timestamp". SCT is signed promise that CT received a precertificate and will add it to its list. SCT registries are append-only. After the certificate is in the CT logs, it will never be deleted.
Structure of SCT
All SCTs are version 1. This is version of SCT specification.
Version: v1 (0x0)
SHA-256 hash identifying which specific CT log issued this receipt
Modern certificates must have at least two or three SCTs, so that browser would trust them. certificate < 180 days2 SCTs 180 days < certificate < 15 months 3 SCTs 15 months < certificatemore than 3
CT logs are operated by different independent organizations (Google, Cloudflare, DigiCert, Sectigo, and others each run logs).
We can isolate and read SCTs with the option "ct_precert_scts". openssl s_client -connect reddit.com:443 </dev/null | openssl x509 -noout -extct_precert_scts
CT logs
I will give you two web sites where you can search through SCTs.
On these web sites you can type the name of your domain and you will get a list of all of the certificates that are issued for that domain.
SCTs are stored in so called "Merkle tree". Each pair of SCTs is hashed, and then results are hashed, until we get a root hash. All SCTs are connected in one big hierarchy. That makes impossible for someone to tamper with SCTs.
Merkle tree is technology that is internally used by blockchain.
Other Extensions
Reddit has the most used and important certificate extensions. There are many more possible extensions, which are usually specialized.
Freshest CRL: URI:http://ca.example.com/delta.crl
Because CRL files have size too big, it is possible to download them incrementally. In that case we only download delta CRL that contains only changes since the last full CRL.
X509v3 Subject Information Access: CA Repository - URI:ldap://ldap.example.com/cn=ExampleCA
This is opposite to AIA. AIA is about CA. SIA is about the certificate owner.
S/MIME Capabilities: AES-256-CBC AES-192-CBC
This email server supports next symmetric encryption algorithms.
