-
-
Notifications
You must be signed in to change notification settings - Fork 10k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
apps/openssl.cnf
default is to not enforce TLS. Should default to: enforce TLS
#24731
Comments
I'm not sure what the request here is @ETERNALBLUEbullrun . Reading the bug you referenced in termux, it seems they are shipping with the default configuration and assuming everything is 'ok'. Is the ask to default those configuration settings to be off? I'm going to guess based on the comments by the configuration that cmp sets those on as a tradeoff between doing things correctly, and actually working with a large number of cmp servers in the wild. @DDvO you created those entries back in 2020. Can you comment on their need, and weather or not we should continue to have them as defaults? |
This issue pretty clearly is a result of misinterpreting the semantics of the default OpenSSL config file.
and has nothing to do with TLS. Closing as invalid. |
Insta is a common Certificate Authority. The issue is that the defaults should not accept "self-signed"/"missing" certificates. The The issue is a wish to default to
plus, if this fails for lots of uses (test was just with Termux; does not fail with Termux,) |
With your new text your issue makes somewhat more sense. Yet still the two options mentioned have no relation with TLS. They only affect how the client handles CMP-level message protection, which may be missing or use a server cert for signing that is not allowed for signing data. This example configuration does not use TLS for connecting to the Insta Demo CA. Anyway, maybe the two mentioned quirk options are no more needed for successfully running demo exchanges. In particular, the latter is mostly needed for handling strange behavior of EJBCA. Please have a closer look at the documentation and revise your issue including its title. |
On a second thought, also having a look at termux/termux-packages#19208 I'm going to extend the documentation and the example config file to make crystal clear that CMP is entirely independent of the message transfer and any transport-layer protection such as TLS. |
Am confused. Do these options just affect hosts? PKI is common, lots of clients use PKI with TLS;
https://datatracker.ietf.org/doc/html/rfc9483 has
Does the "undefined behaviour" from |
thank you @DDvO and @ETERNALBLUEbullrun for talking this one out @DDvO given that you said you were going to extend the docs above, I'm assigning this one to you. Please let me know if that needs to change |
@ETERNALBLUEbullrun, despite my above clarifying comments, you still mix up CMP and TLS. CMP is an application-level protocol which is usually run over HTTP which may be tunneled over TLS, |
https://github.com/openssl/openssl/blob/master/apps/openssl.cnf#L345
Lots of projects such as Termux ( termux/termux-packages#19208 ) use your defaults as-is,
which your manpages ( https://www.openssl.org/docs/man3.0/man1/openssl-cmp.html ) list as;
The text was updated successfully, but these errors were encountered: