Generate Keymaster CA to be used as client only certificates

[bjhaid]

This will allow distributing the CA certificate to machines for trust and not worry about the certificate trusting servers. The certificate should probably have only the ExtKeyUsageClientAuth bit set

[cviecco]

Do you mean keymaster's CA cert as dowloaded from https://keymaster.example.com/public/x509ca. I dont understand te question (why would clients want this cert anyway?). Or if its something else can you explain an provide steps for reproducing?

[rgooch]

@bjhaid Ping?

[bjhaid]

I dont understand te question (why would clients want this cert anyway?).

This certs need to be trusted on the clients machine to prevent the continuous prompts to manually trust the certificate. To prevent the CA from being used to issue a server cert that can MITM the user's traffic, the CA needs to explicitly indicate it is only used for signing clients certs and nothing more. As it is today the CA can be used to sign both server and client certificates.

[cviecco]

@bjhaid what OS/browser combination are you seeing?
The expected behavior (when using a browser) is:

1. The browser connects to the server and in the TLS handshake asks for an optional client side certificate. The server side certificate should be signed by a trusted authority.
2. There should not be a need to inject the keymasterCA to users's browser, it should only be needed by servers that want to trust keymaster x509 certificates for clients (and while we could add the needed x509 flags) I am confused by the ask.
3. The clients should try to NOT use the optional cert (but chrome does not do this, instead is asks if there is any cert client want to use, and users should cancel/ignore this). After this no more client interaction is expected.

Can you detail here the behaviour you are seeing? and what are you expecting?

[bjhaid]

the behavior I am seeing is:

1. browser asks me for client cert to present to server as below(issuer and serial intentionally grayed out) :

2. I get the prompt in asking to trust as in the screenshot

That prompt shows up 4-5 times

When I had not trusted the server's CA I would get prompt number 2 every time I tried logging into keymaster/cloudgate. To prevent that from happening, rather than requiring every user to manually trust the cert we can instead distribute it to the users.