SslStream delayed client certificate with legacy OpenSSL #55761

Activity

1. wfurt

   added

   area-System.Net.Security

   os-linuxLinux OS (any supported distro)Linux OS (any supported distro)

   on Jul 15, 2021
3. ghost added

   untriagedNew issue has not been triaged by the area ownerNew issue has not been triaged by the area owner

   on Jul 15, 2021
4. wfurt commented on Jul 15, 2021

   

   wfurt

   on Jul 15, 2021

   MemberAuthor

   More actions

   related to #49346
5. karelz

   added

   enhancementProduct code improvement that does NOT require public API changes/additionsProduct code improvement that does NOT require public API changes/additions

   and removed

   untriagedNew issue has not been triaged by the area ownerNew issue has not been triaged by the area owner

   on Jul 15, 2021
6. karelz

   added this to the 6.0.0 milestone on Jul 15, 2021
7. karelz commented on Jul 15, 2021

   

   karelz

   on Jul 15, 2021

   Member

   More actions

   Triage: We should add the PNSE and check OpenSSL 3.0 for 6.0 release.
   Then we can move it to Future or decide to close as the legacy OpenSSL versions are being pushed out of distros.
8. karelz

   assigned

   aik-jahoda

   on Jul 19, 2021
9. aik-jahoda commented on Jul 27, 2021

   

   aik-jahoda

   on Jul 27, 2021

   Last edited by karelz

   Contributor

   More actions

   Tested following configuration:

   • .NET SslStream authenticated as server (on OpenSsl 1.0.0t).
   • OpenSsl s_clients (non-.NET): OpenSSL 1.0.0t, OpenSSL 1.1.1k, OpenSSL 3.0.0-beta1
     The above configuration works as expected.

   If we use SslStream client with OpenSSL 1.0.0/1.1.0, then it fails.
   The SslStream client works only with OpenSSL 1.1.1.

   SslStream authenticated as client is without change, throwing PNSE (when using openssl version smaller than 1.1.1) would

   1. be breaking change
   2. be not nice as the exception would be triggered by server (when requesting certificate) and would depends on server. Instead client shouldn't ignore server HELLO request.

   ❤️React with ❤️1Reacted by Karel Zikmund
10. karelz commented on Jul 27, 2021

    

    karelz

    on Jul 27, 2021

    Last edited by karelz

    Member

    More actions

    Triage: Given that we didn't throw PNSE in 5.0, but relied on server reaction to unsupported feature (e.g. refused connection, etc.), it is fine to keep it in 6.0 the same way for certain older OpenSSL versions (which are on older distros which in time will be out of support anyway).
    If there is business demand in future, we can reconsider.

    Close
11. karelz

    closed this as completedon Jul 27, 2021
12. ghost locked as resolved and limited conversation to collaborators on Aug 26, 2021