{"id":207,"date":"2012-09-20T20:40:40","date_gmt":"2012-09-21T04:40:40","guid":{"rendered":"http:\/\/unmitigatedrisk.com\/?p=207"},"modified":"2012-09-20T20:40:40","modified_gmt":"2012-09-21T04:40:40","slug":"a-look-at-expired-certificates","status":"publish","type":"post","link":"https:\/\/unmitigatedrisk.com\/?p=207","title":{"rendered":"A look at expired certificates"},"content":{"rendered":"

Today I was on a mail thread where the topic of how browsers handle expired certificates; this is particularly relevant for a few reasons.<\/p>\n

The first of which is that there is a large number of sites operating with expired certificates out on the Internet today, the other is that the adoption of short lived certificates (which I am a fan of) is at least in part dependent on how browsers deal with certificates that are expired.<\/p>\n

In any event I was not sure how the most recent versions of browsers were handling these cases so I dug up an example site where an expired certificate was in use (https:\/\/www.appliancetherapy.com \u2013 it uses a certificate that expired a few weeks ago and has not as of yet been replaced).<\/p>\n

So what did I want to find? In a perfect world I believe that the following should be true:<\/p>\n

    \n
  1. Users are warned or prohibited from going to the site in question.<\/li>\n
  2. The warning language used is easy to understand and explains the risks.<\/li>\n
  3. The warning language used is related to the fact that the certificate is expired.<\/li>\n
  4. The trust indicator does not show or is marked to indicate that there is a problem.<\/li>\n<\/ol>\n

    The good news is that for the most part browsers behaved fairly close to this, they all could have improved language but I believe Internet Explorers was the best.<\/p>\n

    The worst behaving client was Mozilla, as it doesn\u2019t report the certificate as expired but instead indicates that it tried to make an OCSP request but got a response it was not expecting. This has two problems \u2013 the first of which being it should not have made an OCSP request for the status of an expired request.<\/p>\n

    RFC 5280<\/a>\u00a0Section 5 states that:<\/p>\n

     <\/p>\n

    \u00a0\u00a0 A complete CRL lists all unexpired certificates, within its scope,<\/p>\n

    \u00a0 \u00a0that have been revoked for one of the revocation reasons covered by<\/p>\n

    \u00a0\u00a0 the CRL scope.\u00a0 A full and complete CRL lists all unexpired<\/p>\n

    \u00a0\u00a0 certificates issued by a CA that have been revoked for any reason.<\/p>\n

     <\/p>\n

    And\u00a0RFC 2560<\/a>\u00a0is written largely based on OCSP responses being fed from CRLs. What this means is that it is not appropriate to ask the revocation status of a certificate that is expired.<\/p>\n

    The next problem is that Mozilla also doesn\u2019t handle the unauthorized response in a usable way.\u00a0RFC 5019<\/a>\u00a0Section 2.2.3 states:<\/p>\n

     <\/p>\n

    \u00a0\u00a0\u00a0The response “unauthorized” is returned in cases where the client<\/p>\n

    \u00a0\u00a0\u00a0is not authorized to make this query to this server or the server<\/p>\n

    \u00a0\u00a0\u00a0is not capable of responding authoritatively.<\/p>\n

     <\/p>\n

    A user who receives this message would believe the issue is related to their permissions but based on the true reason for the error the failure as really that the responder in question doesn\u2019t have the information that\u2019s needed.<\/p>\n

    This lack of information on the server is likely due to the fact that it isn\u2019t required to maintain information for expired certificates and the message Mozilla delivered should have been about the certificate being expired.<\/p>\n

    In any event the browsers behaved much better than I expected, IE and Chrome did the best (I really like Chromes red \/ over the https as a visual queue there is a problem).<\/p>\n

     <\/p>\n

     <\/p>\n

    <\/h2>\n

    Chrome<\/h2>\n

    \"\"<\/a><\/p>\n

    Internet Explorer<\/h2>\n

    \"\"<\/a><\/p>\n

    Mozilla<\/h2>\n

    \"\"<\/a><\/p>\n

    Opera<\/h2>\n

    \"\"<\/a><\/p>\n

    Safari<\/h2>\n

    \"\"<\/a><\/p>\n

     <\/p>\n","protected":false},"excerpt":{"rendered":"

    Today I was on a mail thread where the topic of how browsers handle expired certificates; this is particularly relevant for a few reasons. The first of which is that there is a large number of sites operating with expired certificates out on the Internet today, the other is that the adoption of short lived […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[3,4],"tags":[57,56,53,54,55],"class_list":["post-207","post","type-post","status-publish","format-standard","hentry","category-security","category-thoughts","tag-expired-certificate","tag-internet-explorer","tag-mozilla","tag-opera","tag-safari"],"_links":{"self":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/posts\/207","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=207"}],"version-history":[{"count":0,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/posts\/207\/revisions"}],"wp:attachment":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=207"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=207"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=207"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}