Re: gnutls fails to use Verisign CA cert without a Basic Constraint

[Douglas E. Engert]

Simon Josefsson wrote:
> I reconsidered, and think we should push this patch into 2.6.x since it
> helps users deal with RSA-MD5 chains.  The only recommendation we have
> right now is to patch applications to provide an option to accept
> RSA-MD5.  That is still insecure.  With your patch, users will have a
> another transition strategy while they are moving end-entity
> certificates from RSA-MD5 chains to a RSA-SHA1 chain: explicitly trust
> the intermediary RSA-MD5 cert.  Users can make some additional steps to
> mitigate the hazards with RSA-MD5 certs (like comparing it with several
> year old intermediary RSA-MD5 certs before the RSA-MD5 vulnerability
> were common knowledge).
>
> I used your small patch and pushed the following:
>
> http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commitdiff;h=0ca6c0eeb67e3be4f6d79d775f23c3fccba97444
>
> I'll be backporting this to the 2.6.x and 2.4.x branches and make some
> pre-releases.

Looks good.

> Thanks,
> /Simon

--

 Douglas E. Engert  <address@hidden>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439
 (630) 252-5444