tls requires a subject even when altNames are defined #22906

jasonmacgowan · 2018-09-17T15:36:36Z

Behavior described in #11771 is still true even though the issue is closed. This PR is to allow DNS and URI names, even when there is not a subject.

Checklist

make -j4 test (UNIX), or vcbuild test (Windows) passes
tests and/or benchmarks are included
commit message follows commit guidelines

jasonmacgowan · 2018-09-18T14:59:21Z

@bnoordhuis thoughts?

addaleax · 2018-09-22T10:04:48Z

@nodejs/crypto ?

ryzokuken · 2018-09-23T04:08:02Z

/cc @bnoordhuis is it expected to behave like this after #14473?

addaleax · 2018-09-24T21:02:50Z

@jasnell Since you approved this … is this ready to be landed? Is it semver-major?

CI: https://ci.nodejs.org/job/node-test-pull-request/17410/

jasnell · 2018-09-25T00:51:35Z

I'd prefer a look from @nodejs/crypto given the context. It looks fine for me but this particular bit of stuff always can stand more eyes.

bnoordhuis · 2018-09-25T13:54:27Z

lib/tls.js

@@ -204,7 +204,7 @@ exports.checkServerIdentity = function checkServerIdentity(hostname, cert) {
    if (!valid)
      reason = `IP: ${hostname} is not in the cert's list: ${ips.join(', ')}`;
    // TODO(bnoordhuis) Also check URI SANs that are IP addresses.
-  } else if (subject) {
+  } else if (subject || altNames) {


Line 215 is going to throw a TypeError if it tries to read subject.CN when subject == null and altNames does not contain DNS:, IP: or URI: fields.

The logic should be something like } else if (subject || haveAltNames) { where haveAltNames is this:

const haveAltNames = dnsNames.length > 0 || ips.length > 0 || uriNames.length > 0;

I'd swap the branches of the if statement on line 214 so you can write if (haveAltNames) { - negations are to be avoided when possible.

I would have done the opposite: defined const noAltNames because switching the branches textually from their previous location makes the diff larger, and obscures what is actually being changed, which is much smaller.

jasonmacgowan · 2018-09-28T09:04:46Z

@bnoordhuis please review. Thanks!

bnoordhuis · 2018-10-08T09:49:54Z

lib/tls.js

+  hostname = unfqdn(hostname);  // Remove trailing dot for error messages.
+  const hostParts = splitHost(hostname);
+  const wildcard = (pattern) => check(hostParts, pattern, true);
+  const noWildcard = (pattern) => check(hostParts, pattern, false);


It would be better to move these back inside an if statement.

unfqdn() and splitHost() are somewhat expensive operations that the user shouldn't have to pay for when the other branches are taken.

sam-github · 2018-11-27T21:25:51Z

ping @jasonmacgowan

jasonmacgowan · 2018-12-01T13:43:40Z

@bnoordhuis take 3; please review. Thanks!

cc: @sam-github

sam-github · 2018-12-03T19:07:51Z

It surprised me that the check against a subjectAlternativeName didn't fall back on failure to the CN attribute of the subject, but I found that is required, at least it is here: https://tools.ietf.org/html/rfc6125#section-6.4.4

However, the domainComponent (if used, its likely uncommon) of the subject does look like it can be checked as a backup to the alt name: https://tools.ietf.org/html/rfc5280#section-4.2.1.6 But... we don't support that. Unrelated to this PR.

While I agree in general with Ben's point about negatives in conditionals, in this case I think it causes excessive churn, but I'll leave that to him to comment on.

So, just one request: can you please ensure that tests exist with a subject CN, proving that it is disregarded for matching the hostname when when an alt name exists, but only if the altname contains one of the 3 "domainish" attributes? I think that'd be at least two tests.

adamrobertbacon · 2019-04-13T17:00:51Z

Is it cheeky for me to bump this issue. I have been dabbling my feet into nodejs for the first time and I've just fallen foul of the issue myself. My internal CA provider has decided to start using certs with an empty subject line. Could find no way around it so I had to allow unauthorised connections for an LDAPS lookup. Not the end of the world but far from ideal. Keep up the good work!

jasonmacgowan · 2019-04-15T13:10:05Z

@adamrobertbacon check out auth0/ad-ldap-connector@1f4dd2b for a decent work around that doesn't require allowing all certs blindly.

rajha-korithrien · 2019-05-31T14:10:38Z

If it was cheeky for @adamrobertbacon to ping this issue back in April, I suppose it is even more cheeky for me to ping it in late May??

Thanks @jasonmacgowan for this code and a pointer to ad-ldap-connector. It will fit my needs of getting ldapjs to be a client of an Active Directory ldaps server with a default Microsoft self signed certifitate. Said certificate falls exactly into this boat, empty subject, DNS host name as a Subject Alternative Name.

Is there a thought as to what is still needed to get this merged? It is unexpected that an admittedly strange but (to my knowledge) standards conformant cert is not supported by the node.js TLS system.

Thanks!

Monual · 2019-10-31T14:08:17Z

Can we get this approved and merged? This bug is affecting our production environment.

addaleax · 2019-10-31T14:35:58Z

@sam-github You seem knowledgeable here, do you think you could write the tests you requested and push them here?

nodejs-github-bot · 2019-10-31T14:37:50Z

CI: https://ci.nodejs.org/job/node-test-pull-request/26258/

sam-github · 2019-10-31T14:49:26Z

I'd like to, but I just don't have the time. Consider my comment unblocking.

nodejs-github-bot · 2019-11-05T22:27:57Z

CI: https://ci.nodejs.org/job/node-test-pull-request/26380/

nodejs-github-bot · 2019-11-08T11:46:33Z

CI: https://ci.nodejs.org/job/node-test-pull-request/26465/

nodejs-github-bot · 2019-11-19T14:32:02Z

CI: https://ci.nodejs.org/job/node-test-pull-request/26747/

nodejs-github-bot · 2019-11-28T00:48:50Z

CI: https://ci.nodejs.org/job/node-test-pull-request/27120/

nodejs-github-bot · 2019-11-28T01:01:16Z

CI: https://ci.nodejs.org/job/node-test-pull-request/27121/

Behavior described in #11771 is still true even though the issue is closed. This PR is to allow DNS and URI names, even when there is not a subject. Refs: #11771

addaleax · 2019-11-28T01:08:37Z

Squashed and rebased to avoid a merge conflict.

nodejs-github-bot · 2019-11-28T01:09:20Z

CI: https://ci.nodejs.org/job/node-test-pull-request/27124/

nodejs-github-bot · 2019-11-28T12:19:29Z

CI: https://ci.nodejs.org/job/node-test-pull-request/27143/

Behavior described in #11771 is still true even though the issue is closed. This PR is to allow DNS and URI names, even when there is not a subject. Refs: #11771 PR-URL: #22906 Reviewed-By: James M Snell <[email protected]>

addaleax · 2019-11-29T01:14:53Z

Landed in ff48009 🎉

Behavior described in #11771 is still true even though the issue is closed. This PR is to allow DNS and URI names, even when there is not a subject. Refs: #11771 PR-URL: #22906 Reviewed-By: James M Snell <[email protected]>

nodejs-github-bot added the tls Issues and PRs related to the tls subsystem. label Sep 17, 2018

jasonmacgowan mentioned this pull request Sep 17, 2018

tls requires a subject even when altNames are defined #11771

Closed

jasnell approved these changes Sep 22, 2018

View reviewed changes

jasnell requested review from bnoordhuis and shigeki September 25, 2018 00:52

bnoordhuis reviewed Sep 25, 2018

View reviewed changes

joyeecheung mentioned this pull request Sep 25, 2018

CI failures: 20180925 nodejs/reliability#17

Closed

bnoordhuis reviewed Oct 8, 2018

View reviewed changes

This was referenced Jun 24, 2019

Add Support for Private Certificate Authority Signed LDAPS Server Certificates authelia/authelia#374

Closed

Add Support for Private Certificate Authority Signed LDAPS Server Certificates authelia/authelia#375

Merged

Trott force-pushed the master branch from 1ecc406 to 49cf67e Compare September 17, 2019 16:52

addaleax added the author ready PRs that have at least one approval, no pending requests for changes, and a CI started. label Oct 31, 2019

tls: allow empty subject even with altNames defined

22e55f5

Behavior described in #11771 is still true even though the issue is closed. This PR is to allow DNS and URI names, even when there is not a subject. Refs: #11771

addaleax closed this Nov 29, 2019

BridgeAR mentioned this pull request Dec 3, 2019

v13.3.0 proposal #30774

Merged

BethGriggs mentioned this pull request Dec 9, 2019

v12.13.2 proposal #30865

Closed

BethGriggs mentioned this pull request Dec 23, 2019

v12.14.1 proposal #31069

Merged

jportner mentioned this pull request Feb 6, 2020

Kibana doesn't properly trust server certificates with an empty Subject elastic/kibana#57009

Closed

sam-github mentioned this pull request Jun 3, 2020

A possible TODO list for new (or current) contributors #33715

Closed

BethGriggs added the lts-watch-v10.x label Jun 12, 2020

BethGriggs added land-on-v10.x and removed lts-watch-v10.x labels Jul 1, 2020

richardlau mentioned this pull request Jul 2, 2020

v10.22.0 proposal #34170

Merged

4 tasks

eliykat mentioned this pull request Mar 11, 2021

Fix handling of empty subject names in certs bitwarden/directory-connector#102

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

tls requires a subject even when altNames are defined #22906

tls requires a subject even when altNames are defined #22906

jasonmacgowan commented Sep 17, 2018

jasonmacgowan commented Sep 18, 2018

addaleax commented Sep 22, 2018

ryzokuken commented Sep 23, 2018

addaleax commented Sep 24, 2018

jasnell commented Sep 25, 2018

bnoordhuis Sep 25, 2018

sam-github Dec 3, 2018

jasonmacgowan commented Sep 28, 2018

bnoordhuis Oct 8, 2018

sam-github commented Nov 27, 2018

jasonmacgowan commented Dec 1, 2018

sam-github commented Dec 3, 2018

adamrobertbacon commented Apr 13, 2019

jasonmacgowan commented Apr 15, 2019

rajha-korithrien commented May 31, 2019 •

edited

Loading

Monual commented Oct 31, 2019

addaleax commented Oct 31, 2019

nodejs-github-bot commented Oct 31, 2019

sam-github commented Oct 31, 2019

nodejs-github-bot commented Nov 5, 2019

nodejs-github-bot commented Nov 8, 2019

nodejs-github-bot commented Nov 19, 2019

nodejs-github-bot commented Nov 28, 2019

nodejs-github-bot commented Nov 28, 2019

addaleax commented Nov 28, 2019

nodejs-github-bot commented Nov 28, 2019

nodejs-github-bot commented Nov 28, 2019

addaleax commented Nov 29, 2019

tls requires a subject even when altNames are defined #22906

tls requires a subject even when altNames are defined #22906

Conversation

jasonmacgowan commented Sep 17, 2018

Checklist

jasonmacgowan commented Sep 18, 2018

addaleax commented Sep 22, 2018

ryzokuken commented Sep 23, 2018

addaleax commented Sep 24, 2018

jasnell commented Sep 25, 2018

bnoordhuis Sep 25, 2018

Choose a reason for hiding this comment

sam-github Dec 3, 2018

Choose a reason for hiding this comment

jasonmacgowan commented Sep 28, 2018

bnoordhuis Oct 8, 2018

Choose a reason for hiding this comment

sam-github commented Nov 27, 2018

jasonmacgowan commented Dec 1, 2018

sam-github commented Dec 3, 2018

adamrobertbacon commented Apr 13, 2019

jasonmacgowan commented Apr 15, 2019

rajha-korithrien commented May 31, 2019 • edited Loading

Monual commented Oct 31, 2019

addaleax commented Oct 31, 2019

nodejs-github-bot commented Oct 31, 2019

sam-github commented Oct 31, 2019

nodejs-github-bot commented Nov 5, 2019

nodejs-github-bot commented Nov 8, 2019

nodejs-github-bot commented Nov 19, 2019

nodejs-github-bot commented Nov 28, 2019

nodejs-github-bot commented Nov 28, 2019

addaleax commented Nov 28, 2019

nodejs-github-bot commented Nov 28, 2019

nodejs-github-bot commented Nov 28, 2019

addaleax commented Nov 29, 2019

rajha-korithrien commented May 31, 2019 •

edited

Loading