Policy-Discussion

[<ulrich AT cacert.org>]

Hi Guys,

several people are reporting and adding notes to the above named topic.
The main problem:
this problem cannot be solved by development process only.
It probably needs also an update of the CPS policy
http://www.cacert.org/policy/CertificationPracticeStatement.php

This becomes a project state of its own.
Following steps needs to be checked first before
this can be presented to policy group:

1. download a testserver vm x1) and implement the
   proposed changes
2. test the changes localy and deliver a test report
3. present these results to cacert-devel mailing list
   if cacert-devel mailing list gives the ok
   forward the results to the policy group (policy mailing list)
   (cacert-policy)
4. policy group to prepare an update proposal
   for CPS
5. policy group to vote on this proposal
6. system implementation by critical team


regards, uli   ;-)


x1) currently 4 revisions are present
    see download links
    https://wiki.cacert.org/SystemAdministration/Systems/Development


-----Ursprüngliche Nachricht-----
Von: Mantis Bug Tracker 
[mailto:support AT cacert.org]
 
Gesendet: Freitag, 21. Oktober 2011 20:37
An: 
ulrich AT cacert.org
Betreff: [Main CAcert Website 0000540]: No key usage attribute in cacert
org certs anymore?



A NOTE has been added to this issue. 
====================================================================== 
http://bugs.cacert.org/view.php?id=540 ;
====================================================================== 
Reported By:                Thomas Reich
Assigned To:                
====================================================================== 
Project:                    Main CAcert Website
Issue ID:                   540
Category:                   certificate issuing
Reproducibility:            always
Severity:                   major
Priority:                   normal
Status:                     needs feedback
Reviewed by:                 
====================================================================== 
Date Submitted:             2008-04-14 15:01 UTC
Last Modified:              2011-10-21 18:37 UTC
====================================================================== 
Summary:                    No key usage attribute in cacert org certs
anymore?
Description: 
I have just seen that there is no longer a  key usage attribute selectable
and
present for ca cert org client certificates. Only an extended key usage
attribute. This may cause trouble with various software products using
this
attribute to identify the correct usage of the certificate. Why did you
change
this? Does this stay this way? Is this settled in any standard/RFC? (I
have only
found RFCs saying that the attribute SHOULD be present anyway!).
Please check and let me know ... 

Regards,
Thomas Reich
======================================================================
Relationships       ID      Summary
----------------------------------------------------------------------
related to          0000905 Unable to sign PDF file with Acrobat
related to          0000812 CAcert certificate not working with Win...
====================================================================== 

---------------------------------------------------------------------- 
 (0001062) Sourcerer (administrator) - 2008-04-14 15:33
 http://bugs.cacert.org/view.php?id=540#c1062 ;
---------------------------------------------------------------------- 
The key usage attribute wasn't ever selectable at CAcert. We didn't
removed it.
The only place where the usage can be chosen is code-signing for client
certificates. 

---------------------------------------------------------------------- 
 (0001063) Thomas Reich (reporter) - 2008-04-15 07:11
 http://bugs.cacert.org/view.php?id=540#c1063 ;
---------------------------------------------------------------------- 
The strange thing is: With certificates generated in January we have no
problems, but with the new ones. Did you change something in this
timeframe
affecting the structure of the certificates?
However, the key usage should be selectable in the certificates as we know
many
apps that have problems with certs without key usage. 

---------------------------------------------------------------------- 
 (0001064) Zal (reporter) - 2008-04-15 10:35
 http://bugs.cacert.org/view.php?id=540#c1064 ;
---------------------------------------------------------------------- 
This bug makes problem with signing PDFs using Adobe Acrobat software. 

---------------------------------------------------------------------- 
 (0001065) homer (reporter) - 2008-04-15 20:17
 http://bugs.cacert.org/view.php?id=540#c1065 ;
---------------------------------------------------------------------- 
Please, do you mean thoses usages ?

it is an openssl extract from a thawte email certificate

        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Non Repudiation, Key Encipherment, Data
Encipherment, Key Agreement 

---------------------------------------------------------------------- 
 (0001066) Thomas Reich (reporter) - 2008-04-16 06:09
 http://bugs.cacert.org/view.php?id=540#c1066 ;
---------------------------------------------------------------------- 
Yes. That is the correct attribute we need.
Thawte for example sets the values mentioned above for e-mail certs which
is
sufficient. As long as you are working with one key pair within the
certificate.


---------------------------------------------------------------------- 
 (0001120) David Klitzsch (reporter) - 2008-07-29 14:53
 http://bugs.cacert.org/view.php?id=540#c1120 ;
---------------------------------------------------------------------- 
I also want to see the above mentioned key usage flags in the key usage
extension (OID: 2.5.29.15) within CAcert's client certificates because
without
them you can't use CAcert's certificates with Adobe's Acrobat Software.
Not
until CAcert will sign CSR's with non RSA public keys the key agreement
flag is
needed! 

---------------------------------------------------------------------- 
 (0001123) Sourcerer (administrator) - 2008-07-31 18:23
 http://bugs.cacert.org/view.php?id=540#c1123 ;
---------------------------------------------------------------------- 
Can anyone provide a patch? 

---------------------------------------------------------------------- 
 (0001143) janst (reporter) - 2008-08-16 20:16
 http://bugs.cacert.org/view.php?id=540#c1143 ;
---------------------------------------------------------------------- 
I can confirm this bug. I've got at least two programs which refuse to
work with
my CAcert certificate although everything works fine with the Thawte one. 

---------------------------------------------------------------------- 
 (0001148) David Klitzsch (reporter) - 2008-08-19 02:45
 http://bugs.cacert.org/view.php?id=540#c1148 ;
---------------------------------------------------------------------- 
After a short look at the source code I guess that the
client[-*].cnf-files not
being included in the source are required to provide a patch. If these
files are
config files for OpenSSL you have to add the following line in the
respective
X509 V3 extension sections:

keyUsage=critical, digitalSignature, nonRepudiation, keyEncipherment,
dataEncipherment 

---------------------------------------------------------------------- 
 (0001260) David Klitzsch (reporter) - 2008-12-03 21:52
 http://bugs.cacert.org/view.php?id=540#c1260 ;
---------------------------------------------------------------------- 
To provide a patch we need access to the *.cnf-files!!! 

---------------------------------------------------------------------- 
 (0001713) Soeren K (reporter) - 2010-09-08 21:01
 http://bugs.cacert.org/view.php?id=540#c1713 ;
---------------------------------------------------------------------- 
Hi,

like David already said in 0001148, the "keyUsage" have to be set up.
Please referer: http://forums.adobe.com/message/2190102
Please also referer:
http://learn.adobe.com/wiki/download/attachments/52658564/acrobat_reader_s
ecurity_9x.pdf?version=1
( Page 210 -> Table 9 Seed values: certSpec properties -> keyUsage)

 

---------------------------------------------------------------------- 
 (0001852) Soeren K (reporter) - 2011-02-02 09:07
 http://bugs.cacert.org/view.php?id=540#c1852 ;
---------------------------------------------------------------------- 
Hi Sourcerer,

I guess, that is all. But like David wrote... To provide a patch we need
access
to the *.cnf-files!!! 

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
-= User

keyUsage=critical, digitalSignature, nonRepudiation, keyEncipherment,
dataEncipherment

extendedKeyUsage=clientAuth, emailProtection, msSGC, nsSGC,
szOID_KP_SMARTCARD_LOGON

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
-= User + Code Signing

keyUsage=critical, digitalSignature, nonRepudiation, keyEncipherment,
dataEncipherment

extendedKeyUsage=clientAuth, codeSigning, emailProtection,
SPC_INDIVIDUAL_SP_KEY_PURPOSE_OBJID, SPC_COMMERCIAL_SP_KEY_PURPOSE_OBJID,
msSGC,
nsSGC, szOID_KP_SMARTCARD_LOGON

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
-= Web Server

keyUsage=critical, digitalSignature, nonRepudiation, keyEncipherment,
dataEncipherment

extendedKeyUsage=clientAuth, serverAuth, msSGC, nsSGC,
szOID_KP_SMARTCARD_LOGON

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

*** keyUsage ***
critical
digitalSignature                        2.5.29.15.0
nonRepudiation                          2.5.29.15.1
keyEncipherment                         2.5.29.15.2
dataEncipherment                        2.5.29.15.3

*** extendedKeyUsage ***
serverAuth                              1.3.6.1.5.5.7.3.1
clientAuth                              1.3.6.1.5.5.7.3.2
codeSigning                             1.3.6.1.5.5.7.3.3
emailProtection                         1.3.6.1.5.5.7.3.4
SPC_INDIVIDUAL_SP_KEY_PURPOSE_OBJID     1.3.6.1.4.1.311.2.1.21
SPC_COMMERCIAL_SP_KEY_PURPOSE_OBJID     1.3.6.1.4.1.311.2.1.22
msSGC                                   1.3.6.1.4.1.311.10.3.3
szOID_EFS_CRYPTO                        1.3.6.1.4.1.311.10.3.4
szOID_KP_SMARTCARD_LOGON                1.3.6.1.4.1.311.20.2.2
nsSGC                                   2.16.840.1.113730.4.1 

---------------------------------------------------------------------- 
 (0001921) jcurl (reporter) - 2011-04-15 19:55
 http://bugs.cacert.org/view.php?id=540#c1921 ;
---------------------------------------------------------------------- 
Tested with Acrobat 8.0, using a certificate from Class 3 CAcert with code
signing supported. Doesn't work. 

---------------------------------------------------------------------- 
 (0002424) INOPIAE (developer) - 2011-09-13 22:44
 http://bugs.cacert.org/view.php?id=540#c2424 ;
---------------------------------------------------------------------- 
If you use a class 3 certificate created after 1 July 2011 the signing
with in
Acrobat 9.0 works. 

---------------------------------------------------------------------- 
 (0002478) jcurl (reporter) - 2011-09-21 06:40
 http://bugs.cacert.org/view.php?id=540#c2478 ;
---------------------------------------------------------------------- 
Tested with CACert Class 3 certificate 0A418A, renewed certificate my
Class3
certificate (now has a date of 19.Sep) and Acrobat 8.0 doesn't recognise
the
certificate. Created also a new Class3 certificate (has a date of 18.Sep)
and it
won't sign in Acrobat 8.0 either. The properties of the certificate don't
show
any key usage.

"openssl x509 -text" shows

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 57238 (0xdf96)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: O=CAcert Inc., OU=http://www.CAcert.org, CN=CAcert Class 3
Root
        Validity
            Not Before: Sep 18 20:40:22 2011 GMT
            Not After : Sep 17 20:40:22 2013 GMT
        Subject: CN=Jason 
Curl/emailAddress=jcurl AT arcor.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (2048 bit)
                Modulus (2048 bit): <snip>
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            Netscape Comment:
                To get your own certificate for FREE head over to
http://www.CAcert.org
            X509v3 Extended Key Usage:
                E-mail Protection, TLS Web Client Authentication, Code
Signing,
Microsoft Individual Code Signing, Microsoft Commerc
ial Code Signing, Microsoft Encrypted File System, Microsoft Server Gated
Crypto, Netscape Server Gated Crypto
            Authority Information Access:
                OCSP - URI:http://ocsp.cacert.org
            X509v3 Subject Alternative Name:
                
email:jcurl AT arcor.de
 

---------------------------------------------------------------------- 
 (0002623) jheiss (reporter) - 2011-10-21 18:37
 http://bugs.cacert.org/view.php?id=540#c2623 ;
---------------------------------------------------------------------- 
This is (I believe) causing problems with using my cert with the recently
added
S/MIME support in iOS (iPhone/iPad operating system).  iOS doesn't
recognize
CAcert-issued certificates for S/MIME signing or encryption.  I suspect
the lack
of the "digital signature" and "key encipherment" usage specifications is
the
reason.  I've found several references online that other mail clients
require
the certs to have those.  See this Apple forum for further discussion:

https://discussions.apple.com/message/16454097 ;

Issue History 
Date Modified    Username       Field                    Change

====================================================================== 
2008-04-14 15:01 Thomas Reich   New Issue

2008-04-14 15:02 Thomas Reich   Category                 misc =>
certificate
issuing
2008-04-14 15:33 Sourcerer      Note Added: 0001062

2008-04-15 07:11 Thomas Reich   Note Added: 0001063

2008-04-15 10:35 Zal            Note Added: 0001064

2008-04-15 20:17 homer          Note Added: 0001065

2008-04-16 06:09 Thomas Reich   Note Added: 0001066

2008-07-29 14:53 David Klitzsch Note Added: 0001120

2008-07-31 18:23 Sourcerer      Note Added: 0001123

2008-07-31 18:24 Sourcerer      Status                   new => confirmed

2008-08-16 20:16 janst          Note Added: 0001143

2008-08-19 02:45 David Klitzsch Note Added: 0001148

2008-12-03 21:50 David Klitzsch Note Added: 0001259

2008-12-03 21:51 David Klitzsch Note Deleted: 0001259

2008-12-03 21:52 David Klitzsch Note Added: 0001260

2008-12-03 21:52 David Klitzsch Status                   confirmed =>
needs
feedback
2009-02-07 14:57 Nico R         Issue Monitored: Nico R

2010-09-08 20:57 Soeren K       Note Added: 0001713

2010-09-08 20:57 Soeren K       Note Edited: 0001713

2010-09-08 21:01 Soeren K       Note Edited: 0001713

2010-09-08 21:06 Soeren K       Issue Monitored: Soeren K

2011-02-02 09:07 Soeren K       Note Added: 0001852

2011-04-15 19:55 jcurl          Note Added: 0001921

2011-09-13 22:44 INOPIAE        Note Added: 0002424

2011-09-13 22:44 INOPIAE        Relationship added       related to
0000905  
2011-09-21 06:40 jcurl          Note Added: 0002478

2011-09-26 09:16 Uli60          Relationship added       related to
0000812  
2011-09-26 09:16 Uli60          Issue Monitored: Uli60

2011-10-21 18:37 jheiss         Note Added: 0002623

======================================================================

Attachment: smime.p7s
Description: S/MIME cryptographic signature