Support pinned certificates #526
Conversation
| tlscfg.ClientCAs = clientCAs | ||
| } | ||
|
|
||
| if len(cfg.PinnedClientCert) > 0 { | ||
| tlscfg.VerifyPeerCertificate, err = GetPeerCertificatePinVerifier(cfg.PinnedClientCert) |
There was a problem hiding this comment.
for the quic connections, will this conflict with
receptor/pkg/netceptor/conn.go
Line 74 in 2fb942e
There was a problem hiding this comment.
You're right, this will indeed conflict.
|
@fosterseth I fixed the conflict by having the netceptor verify function wrap the pinning verify function, if it exists. Let me know what you think of this. I guess the other solution would be to add a map to the netceptor struct that stores per-config pin fingerprints and have the netceptor-internal verify function do the pinning checks, but that seems like a lot of work. |
788614b to
be2ee9f
Compare
|
@fosterseth @eqrx @shanemcd Can I get a ✔️ on this? |
|
@fosterseth Docs added as requested |
|
pulled this down and tested, works well! Users of course will need to know that if certs are ever refreshed, then this fingerprint will need to be manually updated in the config files. I think that is okay, we don't really have an automatic way to manage certs within receptor mesh as of right now anyways. @shanemcd I'm good with this PR if you are |
| @@ -152,7 +152,6 @@ func (li *Listener) sendResult(conn net.Conn, err error) { | |||
| err: err, | |||
| }: | |||
| case <-li.doneChan: | |||
| case <-li.doneChan: | |||
There was a problem hiding this comment.
What was going on here? Nice find.
Receptor currently allows a user to specify a CA, or list of CAs, that must sign a certificate in order to trust it for a connection. However, there are situations where you want to be able to identify a single certificate, or one of a list of certificates, that should be allowed to connect, and it's not sufficient to just say "any certificate signed by such-and-so CA." The solution to this is certificate pinning, where you list specific certificate fingerprints that should be the only ones to be trusted.
Here are example configuration files exercising this feature:
You can find the fingerprint of a given certificate using
openssl x509 -in certs/testcert-foo.crt -noout -fingerprint -sha256. This PR supports sha256 and sha512, but not sha1, because sha1 is now considered insecure. If sha1 support is desired it can easily be added.