GNU bug report logs - #35787
26.2; gnutls: accessing raw server certificate data

Previous Next

Full log

View this message in rfc822 format

From: Julian Scheid <julians37 <at> gmail.com>
To: Lars Ingebrigtsen <larsi <at> gnus.org>
Cc: 35787 <at> debbugs.gnu.org
Subject: bug#35787: 26.2; gnutls: accessing raw server certificate data
Date: Mon, 8 Jul 2019 22:20:46 -0600

[Message part 1 (text/plain, inline)]

On Mon, Jul 8, 2019 at 8:43 PM Lars Ingebrigtsen <larsi <at> gnus.org> wrote:
>
> Julian Scheid <julians37 <at> gmail.com> writes:
> > Currently, `gnutls-peer-status' only allows accessing high-level
> > information extracted from the certificate, such as the issuer, but not
> > the certificate data itself.
>
> Other details are returned in the process object, like
> gnutls_x509_crt_get_fingerprint of the certificate.

Thanks for pointing this out, but it appears to be hardwired to use
SHA-1 when RFC 5929 requires the hash to use signatureAlgorithm,
or SHA-256 when signatureAlgorithm is MD5 or SHA-1.

> Does this hash relate in any way to gnutls_x509_crt_get_fingerprint?

I _think_ gnutls_x509_crt_get_fingerprint could be used here, although
I haven't verified yet that it satisfies the following requirement
from RFC 5929:

> The hash of the TLS server's certificate [RFC5280] as it appears,
> octet for octet, in the server's Certificate message.

I would assume that it does, though.

So, to make this work it looks like I'd need either

1) the fingerprint, but using the hash function as required by the RFC, or
2) the certificate as a binary blob.

Thanks again,

Julian


On Mon, Jul 8, 2019 at 8:43 PM Lars Ingebrigtsen <larsi <at> gnus.org> wrote:

> Julian Scheid <julians37 <at> gmail.com> writes:
>
> > Hello, I would like to request a feature: accessing the raw certificate
> > of a server connected to via `gnutls-negotiate' (or such).
> >
> > Currently, `gnutls-peer-status' only allows accessing high-level
> > information extracted from the certificate, such as the issuer, but not
> > the certificate data itself.
>
> Other details are returned in the process object, like
> gnutls_x509_crt_get_fingerprint of the certificate.
>
> > Access to the raw certificate data would allow implementing the
> > `tls-server-endpoint' channel binding type as per
> > https://tools.ietf.org/html/rfc5929#section-4.1 , which requires
> >> [t]he hash of the TLS server's certificate [RFC5280] as it
> >> appears, octet for octet, in the server's Certificate message.  Note
> >> that the Certificate message contains a certificate_list, in which
> >> the first element is the server's certificate.
>
> Does this hash relate in any way to gnutls_x509_crt_get_fingerprint?
>
> --
> (domestic pets only, the antidote for overdose, milk.)
>    bloggy blog: http://lars.ingebrigtsen.no
>

[Message part 2 (text/html, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.