dsoumis commented on PR #1098: URL: https://github.com/apache/tomcat/pull/1098#issuecomment-6630446510
> 1. Most (all modern?) TLS clients do not accept ANY_EXTENDED_KEY_USAGE_OID. CAB forum does not allow it. Nor do they accept no EKU. I think the filtering can be simplified to must include SERVER_AUTH_EXTENDED_KEY_USAGE_OID. I wouldn't agree allowing only SERVER_AUTH_EXTENDED_KEY_USAGE_OID. According to [RFC 5280, Section 4.2.1.12](https://www.rfc-editor.org/rfc/rfc5280.html#section-4.2.1.12), the absence of EKU does not restrict the certificate's extended usage, while anyExtendedKeyUsage explicitly indicates that no EKU-specific restrictions are intended. The RFC does allow applications to enforce stricter requirements, but it does not mandate serverAuth exclusively. Looking at actual implementations, I don't think the claim about modern TLS clients holds: [OpenJDK's EndEntityChecker](https://github.com/openjdk/jdk/blob/master/src/java.base/share/classes/sun/security/validator/EndEntityChecker.java) explicitly accepts serverAuth, anyExtendedKeyUsage, and absent EKU when validating TLS server certificates. [OpenSSL's verification documentation](https://docs.openssl.org/4.0/man1/openssl-verification-options/) also permits anyExtendedKeyUsage and does not require EKU to be present for TLS server verification. The [CA/Browser Forum Baseline Requirements](https://cabforum.org/working-groups/server/baseline-requirements/requirements/#712710-subscriber-certificate-extended-key-usage) do indeed mandate serverAuth and prohibit anyExtendedKeyUsage, but these requirements govern the issuance of publicly trusted TLS certificates. They don't apply to private PKIs, self-signed certificates, or internal enterprise deployments. I don't see a reason to introduce a stricter policy than the RFC and the underlying TLS implementations require. For reference: | Client / Validator | No EKU extension | `anyEKU` only | |---|:---:|:---:| | OpenSSL 3.5 (`sslserver` purpose) | ✅ Accept | ❌ Reject | | Firefox (`mozilla::pkix`) | ✅ Accept | ❌ Reject | | BoringSSL (`SERVER_AUTH`, non-strict) | ✅ Accept | ✅ Accept | | OpenJDK (`EndEntityChecker`) | ✅ Accept | ✅ Accept | | Apple iOS 13+ / macOS 10.15+ (certs issued after 2019-07-01) | ❌ Reject | ❌ Reject | -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
