{"action":"created","issue":{"url":"https://api.github.com/repos/ARMmbed/mbedtls/issues/220","labels_url":"https://api.github.com/repos/ARMmbed/mbedtls/issues/220/labels{/name}","comments_url":"https://api.github.com/repos/ARMmbed/mbedtls/issues/220/comments","events_url":"https://api.github.com/repos/ARMmbed/mbedtls/issues/220/events","html_url":"https://github.com/ARMmbed/mbedtls/issues/220","id":96643238,"number":220,"title":"mbedtls incorrectly fails validation of TLS chains that has a useless/broken tail","user":{"login":"hannes-landeholm","id":948471,"avatar_url":"https://avatars.githubusercontent.com/u/948471?v=3","gravatar_id":"","url":"https://api.github.com/users/hannes-landeholm","html_url":"https://github.com/hannes-landeholm","followers_url":"https://api.github.com/users/hannes-landeholm/followers","following_url":"https://api.github.com/users/hannes-landeholm/following{/other_user}","gists_url":"https://api.github.com/users/hannes-landeholm/gists{/gist_id}","starred_url":"https://api.github.com/users/hannes-landeholm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hannes-landeholm/subscriptions","organizations_url":"https://api.github.com/users/hannes-landeholm/orgs","repos_url":"https://api.github.com/users/hannes-landeholm/repos","events_url":"https://api.github.com/users/hannes-landeholm/events{/privacy}","received_events_url":"https://api.github.com/users/hannes-landeholm/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ARMmbed/mbedtls/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-07-22T19:15:58Z","updated_at":"2015-08-26T09:39:45Z","closed_at":null,"body":"There has been lots of root certificates removed from mozilla lately that has caused problems for me when using a mbedtls based TLS client. I've found at least two sites on the web send an invalid tail of certificate chains that can be ignored. The end of the tail consists of legacy certificates that is no longer trusted but it doesn't matter because an intermediary certificate in the chain is trusted by an installed root certificate.\r\n\r\nE.g. server sends: A <- B <- C\r\n\r\nWe don't trust C as a \"top\" certificate anymore because it depends on a deprecated/legacy root certificate. However B is now trusted as a \"top\" certificate by a new trusted root certificate and we didn't really need to check C in the first place.\r\n\r\nIn essence, if we can trust any of the certs in the chain as a top certificate, we don't need to proceed by walking further down the chain and can simply return an OK status instead and ignoring the rest of the chain. From my experiments this is how certificate validation is normally done and how it's not done in mbedtls.\r\n\r\nThis is my suggested fix: https://github.com/jumpstarter-io/librcd/commit/0f7c0386093242abecf7b0eada7abf7607f1f29d\r\n\r\nAnother fix is of course to tell all the people on the internet with a bad certificate chain to fix it by removing the useless tail certificates but unfortunately few of them will care.\r\n"},"comment":{"url":"https://api.github.com/repos/ARMmbed/mbedtls/issues/comments/134923691","html_url":"https://github.com/ARMmbed/mbedtls/issues/220#issuecomment-134923691","issue_url":"https://api.github.com/repos/ARMmbed/mbedtls/issues/220","id":134923691,"user":{"login":"cblach","id":5312687,"avatar_url":"https://avatars.githubusercontent.com/u/5312687?v=3","gravatar_id":"","url":"https://api.github.com/users/cblach","html_url":"https://github.com/cblach","followers_url":"https://api.github.com/users/cblach/followers","following_url":"https://api.github.com/users/cblach/following{/other_user}","gists_url":"https://api.github.com/users/cblach/gists{/gist_id}","starred_url":"https://api.github.com/users/cblach/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cblach/subscriptions","organizations_url":"https://api.github.com/users/cblach/orgs","repos_url":"https://api.github.com/users/cblach/repos","events_url":"https://api.github.com/users/cblach/events{/privacy}","received_events_url":"https://api.github.com/users/cblach/received_events","type":"User","site_admin":false},"created_at":"2015-08-26T09:39:45Z","updated_at":"2015-08-26T09:39:45Z","body":"Any progress on this issue?. It concerns quite a number of certificates, including a number of Amazon and Google certificates."}}