RFC8737 and MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION

[ndilieto]

Enhancement\Feature Request

Justification
mbedtls_x509_crt_parse_der refuses to parse X509 certificates with unsupported critical extensions unless configured with MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION, which is a security risk. This is very different from the approach of GnuTLS and OpenSSL, which can parse such certificates, and only fail to validate them (OpenSSL for example has a -ignore_critical command line switch to allow ignoring critical extensions).

Also note that it is currently possible to use mbedtls_x509write_crt_set_extension to generate certificates with arbitrary critical extensions regardless of whether MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION is enabled or disabled.

In order to support RFC8737 - ACME TLS ALPN Challenge Extension, the ualpn software currently needs to parse certificates with a new critical extension that mbedTLS does not recognize. So users wishing to use mbedTLS as a backend, must build it with MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION, see ndilieto/uacme#23 and http://lists.busybox.net/pipermail/buildroot/2020-April/281084.html

Suggested enhancement
Allow mbedtls_x509_crt_parse_der to parse X509 certificates with unsupported critical extensions, like GnuTLS and OpenSSL do, and move their rejection at validation stage.

[gilles-peskine-arm]

Hi Nicola,

I agree that the library should have something better than MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION, and that build option is likely to be removed in Mbed TLS 3.0.

This has come up before, at least, in OpenVPN. Lev Stipakov has proposed a patch, but there are still design issues to resolve. If you have thoughts about the design, please share them here or on the Mbed TLS mailing list.

It's unlikely that the Mbed TLS team will have time to work actively on this feature in the near or medium term. However, if Lev, you or someone else is willing to work on it, we'll strive to review designs and code.

[ndilieto]

I made a pull request addressing this issue: #3243

[chris-jones-arm]

As #3243 has been merged for a while now it looks like this issue can be closed.