Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[TLS 1.3] Enable post-handshake auth for OpenSSL 1.1.1 #3026

Closed
tiran opened this issue Sep 21, 2018 · 1 comment
Closed

[TLS 1.3] Enable post-handshake auth for OpenSSL 1.1.1 #3026

tiran opened this issue Sep 21, 2018 · 1 comment
Labels
TLS

Comments

@tiran
Copy link
Contributor

tiran commented Sep 21, 2018

Curl does neither call SSL_CTX_set_post_handshake_auth() nor SSL_set_post_handshake_auth() to enable TLS 1.3's post handshake authentication feature. TLS 1.3 does no longer support renegotiation, therefore PHA is required when the server requires TLS client cert auth depending on HTTP method and/or path. OpenSSL 1.1.1 changed PHA to opt-in.

I noticed the issue while I was working on PHA support for Python. I wanted to verify my implementation with curl...

Resources:
@bagder bagder added the TLS label Sep 21, 2018
@tiran
Copy link
Contributor Author

tiran commented Sep 21, 2018

It might be sufficient to just call the function. I'm not fully sure how the actual PHA handshake works with HTTP. If I understand the Apache mod_ssl implementation correctly, then it's like HTTP STARTTLS. The server sends a HTTP connection upgrade request along a CertRequest TLS message. The client response with an upgrade confirmation along with Certificate, CertificateVerify, and Finish TLS message.

tiran added a commit to tiran/curl that referenced this issue Sep 21, 2018
@tiran
Enable TLS 1.3 post-handshake auth
63478ff 
OpenSSL 1.1.1 requires clients to opt-in for post-handshake
authentication.

Fixes: curl#3026
Signed-off-by: Christian Heimes <christian@python.org>
@tiran tiran mentioned this issue Sep 21, 2018
Closed
tiran added a commit to tiran/curl that referenced this issue Sep 21, 2018
@tiran
Enable TLS 1.3 post-handshake auth
72ec3e8 
OpenSSL 1.1.1 requires clients to opt-in for post-handshake
authentication.

Fixes: curl#3026
Signed-off-by: Christian Heimes <christian@python.org>
tiran added a commit to tiran/curl that referenced this issue Sep 21, 2018
@tiran
Enable TLS 1.3 post-handshake auth
041a06b 
OpenSSL 1.1.1 requires clients to opt-in for post-handshake
authentication.

Fixes: curl#3026
Signed-off-by: Christian Heimes <christian@python.org>
@bagder bagder closed this as completed in b939bc4 Sep 24, 2018
@lock lock bot locked as resolved and limited conversation to collaborators Dec 23, 2018
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
TLS
Milestone
No milestone
Development

No branches or pull requests
2 participants
@bagder @tiran