Generate Keymaster CA to be used as client only certificates about keymaster HOT 5 OPEN

Do you mean keymaster's CA cert as dowloaded from https://keymaster.example.com/public/x509ca. I dont understand te question (why would clients want this cert anyway?). Or if its something else can you explain an provide steps for reproducing?

from keymaster.

@bjhaid Ping?

from keymaster.

I dont understand te question (why would clients want this cert anyway?).

This certs need to be trusted on the clients machine to prevent the continuous prompts to manually trust the certificate. To prevent the CA from being used to issue a server cert that can MITM the user's traffic, the CA needs to explicitly indicate it is only used for signing clients certs and nothing more. As it is today the CA can be used to sign both server and client certificates.

from keymaster.

@bjhaid what OS/browser combination are you seeing?
The expected behavior (when using a browser) is:

1. The browser connects to the server and in the TLS handshake asks for an optional client side certificate. The server side certificate should be signed by a trusted authority.
2. There should not be a need to inject the keymasterCA to users's browser, it should only be needed by servers that want to trust keymaster x509 certificates for clients (and while we could add the needed x509 flags) I am confused by the ask.
3. The clients should try to NOT use the optional cert (but chrome does not do this, instead is asks if there is any cert client want to use, and users should cancel/ignore this). After this no more client interaction is expected.

Can you detail here the behaviour you are seeing? and what are you expecting?

from keymaster.

the behavior I am seeing is:

1. browser asks me for client cert to present to server as below(issuer and serial intentionally grayed out) :

2. I get the prompt in asking to trust as in the screenshot

When I had not trusted the server's CA I would get prompt number 2 every time I tried logging into keymaster/cloudgate. To prevent that from happening, rather than requiring every user to manually trust the cert we can instead distribute it to the users.

from keymaster.