<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0">
<base href="https://issues.shibboleth.net/jira">
<title>Message Title</title>
</head>
<body class="jira" style="color: #333333; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.429">
<table id="background-table" cellpadding="0" cellspacing="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; background-color: #f5f5f5; border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt" bgcolor="#f5f5f5">
<!-- header here -->
<tbody>
<tr>
<td id="header-pattern-container" style="padding: 0px; border-collapse: collapse; padding: 10px 20px">
<table id="header-pattern" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td id="header-avatar-image-container" valign="top" style="padding: 0px; border-collapse: collapse; vertical-align: top; width: 32px; padding-right: 8px" width="32"> <img id="header-avatar-image" class="image_fix" src="cid:jira-generated-image-avatar-25fbb049-d4c7-45de-855c-541ea764df1a" height="32" width="32" border="0" style="border-radius: 3px; vertical-align: top"> </td>
<td id="header-text-container" valign="middle" style="padding: 0px; border-collapse: collapse; vertical-align: middle; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px"> <a class="user-hover" rel="philip.smart@corp.jisc.ac.uk" id="email_philip.smart@corp.jisc.ac.uk" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=philip.smart%40corp.jisc.ac.uk" style="color:#0052cc;; color: #3b73af; text-decoration: none">Philip Smart</a> <strong>commented</strong> on <a href="https://issues.shibboleth.net/jira/browse/JDUO-18" style="color: #3b73af; text-decoration: none"><img src="cid:jira-generated-image-avatar-8849a387-9340-4c03-8395-43631a398fde" height="16" width="16" border="0" align="absmiddle" alt="Task"> JDUO-18</a> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="email-content-container" style="padding: 0px; border-collapse: collapse; padding: 0 20px">
<table id="email-content-table" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; border-spacing: 0; border-collapse: separate">
<tbody>
<tr>
<!-- there needs to be content in the cell for it to render in some clients -->
<td class="email-content-rounded-top mobile-expand" style="padding: 0px; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 15px; background-color: #ffffff; border-left: 1px solid #cccccc; border-top: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom: 0; border-top-right-radius: 5px; border-top-left-radius: 5px; height: 10px; line-height: 10px; padding: 0 15px 0 16px; mso-line-height-rule: exactly" height="10" bgcolor="#ffffff"> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0px; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff">
<table class="page-title-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td style="vertical-align: top;; padding: 0px; border-collapse: collapse; padding-right: 5px; font-size: 20px; line-height: 30px; mso-line-height-rule: exactly" class="page-title-pattern-header-container"> <span class="page-title-pattern-header" style="font-family: Arial, sans-serif; padding: 0; font-size: 20px; line-height: 30px; mso-text-raise: 2px; mso-line-height-rule: exactly; vertical-align: middle"> <a href="https://issues.shibboleth.net/jira/browse/JDUO-18" style="color: #3b73af; text-decoration: none">Re: Add a Trust Engine with pinned root CA certificates to the Duo Nimbus HTTP Client</a> </span> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="text-paragraph-pattern-top" class="email-content-main mobile-expand comment-top-pattern" style="padding: 0px; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff; border-bottom: none; padding-bottom: 0" bgcolor="#ffffff">
<table class="text-paragraph-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 2px">
<tbody>
<tr>
<td class="text-paragraph-pattern-container mobile-resize-text " style="padding: 0px; border-collapse: collapse; padding: 0 0 10px 0"> <p style="margin: 10px 0 0 0; margin-top: 0">Externalizing some findings, nothing particularly novel, any corrections appreciated.</p> <p style="margin: 10px 0 0 0">Enabling CRL checking in the native J2SE X509TrustManagerImpl requires setting the com.sun.net.ssl.checkRevocation system property to true. This is set by the PKIXValidator directly onto the PKIXBuilderParameters e.g. #setRevocationEnabled. This informs the SunCertPathBuilder to add a revocation checker to perform CRL (and, if enabled separately, OCSP) checking.</p> <p style="margin: 10px 0 0 0">By default, the revocation checker only checks those CRLs statically loaded into the CertStore. It does not check CRLs from their distribution point (CRLDP) defined in the relevant X509 certificate extensions. To enable fetching CRLs from their distribution points, the revocation checker respects the com.sun.security.enableCRLDP system property.</p> <p style="margin: 10px 0 0 0">OCSP revocation checking (which requires network lookup - ignoring server-side stapling for this discussion because I can not see Duo do that) can be enabled by setting the ocsp.enable <b>security</b> property. I believe this can only be set in the $JAVA_HOME/jre/lib/security/java.security file or programmatically via a call to java.security.Security.setProperty("oscp.enable",true). Subject, of course, to any security manager restrictions - I doubt applies here.</p> <p style="margin: 10px 0 0 0">Creation of the IdPs PKIXX509CredentialTrustEngine using the StaticPKIXFactoryBean instantiates a default CertPathPKIXTrustEvaluator which enables revocation (in the PKIXBuilderParameters) if the CertStore has CRLs loaded statically (injected initially into the StaticPKIXFactoryBean ). It appears to allow an override to force enabling a revocation checker using a CertPathPKIXValidationOptions setting, but that does not seem injectable - perhaps that is from the legacy security:TrustEngine in older versions of the IdP, I am not sure.</p> <p style="margin: 10px 0 0 0">So far, as I see it in the IdP:</p>
<ul>
<li>To <b>enable</b> <b>CRL</b> <b>checking</b> from a known, fixed, resource, you must provide a CRL (e.g. a URL) as input to the StaticPKIXFactoryBean. This, in effect, enables revocation checking in the PKIXBuilderParameters built by the CertPathPKIXTrustEvaluator such that the Sun CertPathBuilder adds a revocation checker. This will only check the CRL from that fixed resource (placed into the CertStore), it does not look at those defined in the certificates distribution point.</li>
<li>To <b>enable</b> <b>CRL</b> <b>checking</b> from a <b>CRLDP</b> (resource) defined in the certificate - so ones not explicitly defined by the IdP, but taken ‘live’ from the certificate. You must configure a known, fixed, CRL resource as input to the StaticPKIXFactoryBean to, in effect, enable revocation checking in the PKIXBuilderParameters, <b>and</b> you must set the system property com.sun.security.enableCRLDP (well, if you are using the existing Java Revocation checker, probably sensible given the complexity). Note, the CRL resource you configure as input to the StaticPKIXFactoryBean does not have to be an ‘approved’ CRL e.g. it could, for example, have an issuer mismatch and not actually be used, it just allows the enabling of the revocation checker.</li>
<li>To <b>enable</b> <b>OCSP</b> <b>checking</b> from the OCSP endpoints in the certificate, you must also first configure a known, fixed, CRL resource as input to the StaticPKIXFactoryBean, in addition to setting the oscp.enabled <b>security</b> system property to true (in any of the two ways described above).</li>
<li>To <b>enable</b> <b>both</b> <b>OCSP</b> and <b>CRLDP</b> <b>checking</b>. You need to do all of the above e.g. provide a CRL to the StaticPKIXFactoryBean and turn on the various system and security properties.</li>
<li>To <b>enable</b> a <b>known</b> <b>CRL</b> <b>resource</b>, <b>CRLDP</b> resources from the certificate, and <b>OCSP</b>, you must again do all of the above, but make sure you give it an ‘approved’ or ‘valid’ fixed/known CRL resource to check against.</li>
</ul> <p style="margin: 10px 0 0 0">I am thinking it is maybe intentional to prefer CRL checks only from known CRL resources - hence why it is not so clear how to only enable CRL checking from distribution points via the factory builder? That does also make enabling OCSP checks a bit more tricky. The StaticPKIXFactoryBean may benefit from including an override to enable it. Of course, I could be missing an alternative mechanism to configure it.</p> <p style="margin: 10px 0 0 0">I guess having a CRL come from a DP and checked for every TLS handshake will impact performance, maybe a reason for only loading the CRL resource once during bean creation. Although I am not sure what happens once the preconfigured CRL that is loaded expires, I can not see it is refetched, I think it would just stop being used by the Revocation checker. Also, I think there may be a way to cache DP fetched CRLs (not looked into it, I do not think it does by default).</p> <p style="margin: 10px 0 0 0">Enabling OCSP checking is less obvious, as you need to enable revocation checking by configuring a CRL resource in addition to setting a system Security property (programmatically or by system-wide java policy). </p> <p style="margin: 10px 0 0 0">Once configured, it all seems to work!</p> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0px; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff">
<table id="actions-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px">
<tbody>
<tr>
<td id="actions-pattern-container" valign="middle" style="padding: 0px; border-collapse: collapse; padding: 10px 0 10px 24px; vertical-align: middle; padding-left: 0">
<table align="left" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td class="actions-pattern-action-icon-container" style="padding: 0px; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 0; vertical-align: middle"> <a href="https://issues.shibboleth.net/jira/browse/JDUO-18#add-comment" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none"> <img class="actions-pattern-action-icon-image" src="cid:jira-generated-image-static-comment-icon-317ac510-0636-49eb-8b72-2679aa8cf44e" alt="Add Comment" title="Add Comment" height="16" width="16" border="0" style="vertical-align: middle"> </a> </td>
<td class="actions-pattern-action-text-container" style="padding: 0px; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 4px; padding-left: 5px"> <a href="https://issues.shibboleth.net/jira/browse/JDUO-18#add-comment" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none">Add Comment</a> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table> </td>
</tr>
<!-- there needs to be content in the cell for it to render in some clients -->
<tr>
<td class="email-content-rounded-bottom mobile-expand" style="padding: 0px; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 5px; line-height: 5px; background-color: #ffffff; border-top: 0; border-left: 1px solid #cccccc; border-bottom: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom-right-radius: 5px; border-bottom-left-radius: 5px; mso-line-height-rule: exactly" height="5" bgcolor="#ffffff"> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="footer-pattern" style="padding: 0px; border-collapse: collapse; padding: 12px 20px">
<table id="footer-pattern-container" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td id="footer-pattern-text" class="mobile-resize-text" width="100%" style="padding: 0px; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px"> This message was sent by Atlassian Jira <span id="footer-build-information">(v8.5.4#805004-<span title="0444eab799707f9ad7b248d69f858774aadfd250" data-commit-id="0444eab799707f9ad7b248d69f858774aadfd250}">sha1:0444eab</span>)</span> </td>
<td id="footer-pattern-logo-desktop-container" valign="top" style="padding: 0px; border-collapse: collapse; padding-left: 20px; vertical-align: top">
<table style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td id="footer-pattern-logo-desktop-padding" style="padding: 0px; border-collapse: collapse; padding-top: 3px"> <img id="footer-pattern-logo-desktop" src="https://issues.shibboleth.net/jira/images/mail/atlassian-email-logo.png" alt="Atlassian logo" title="Atlassian logo" width="191" height="24" class="image_fix"> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table>
</body>
</html>