1
Imagine an SSL certificate with the following parameters - we're going to concoct the worst imaginable cert by doing every possible thing wrong:
- Old, vulnerable cipher
- Vulnerable signature alrgorithm
- Wrong signature (signature doesn't match the contents)
- Explicitly revoked (cert is on a CRL we're using)
- CA explicitly marked untrusted in the cert store
- Wrong domain name/CN for the connection
- Expired
- Duplicate of another cert for a different domain
- Self signed
Of all of these error conditions for a certificate, in what order are they checked by the user agent?
Or, putting this another way, if I were to use this horrible certificate on a website, what error message would I get - and once I fixed that, what would be next, and so forth.
These errors all have different implications for the security of the connection, so some errors are objectively more scary than others - but is there a standard defined somewhere that states a "priority" for these problems? (I.e. telling me the cert is expired is silly if it's for the wrong website and using broken encryption)
There are lots of different types of user agents. Every browser is even slightly different. So in what context are you using this TLS/SSL certificate exactly? – Ramhound – 2019-02-11T17:00:47.430
The 1st - vulnerable cipher - is under the control of the SSL implementation/handshake, not the certificate. – garethTheRed – 2019-02-11T17:29:59.287
We could start with a website and go from there (as detailed in the question) - but many of the browsers use the same underlying libraries. OpenSSL and GnuTLS probably account for most of the web traffic on the internet. – Mikey T.K. – 2019-02-11T17:30:41.070
@MikeyT.K. - Chrome, Firefox, and Edge all throw certificate errors due to different conditions. Some simply have stricter rules. – Ramhound – 2019-02-11T18:41:20.700
This answer suggests there is an order of precedence ... https://security.stackexchange.com/a/97176/70929 ... although I don't know the source of this information. The only other reference I can find is this one... https://sites.google.com/site/ddmwsst/digital-certificates#TOC-Purpose ... which suggests that each certificate in the chain is assigned a status code, and that the status code with the highest precedence is taken as the certificate chain status. I can't seem to find the status codes, but presumably there is a defined ordering if it has translated into rankable status codes.
– Dallas – 2019-02-11T19:03:36.527