{"action":"opened","issue":{"url":"https://api.github.com/repos/ARMmbed/mbedtls/issues/506","repository_url":"https://api.github.com/repos/ARMmbed/mbedtls","labels_url":"https://api.github.com/repos/ARMmbed/mbedtls/issues/506/labels{/name}","comments_url":"https://api.github.com/repos/ARMmbed/mbedtls/issues/506/comments","events_url":"https://api.github.com/repos/ARMmbed/mbedtls/issues/506/events","html_url":"https://github.com/ARMmbed/mbedtls/issues/506","id":159980707,"number":506,"title":"Requesting client certificates without configuring a client CA certificate chain","user":{"login":"aaronmdjones","id":3105118,"avatar_url":"https://avatars.githubusercontent.com/u/3105118?v=3","gravatar_id":"","url":"https://api.github.com/users/aaronmdjones","html_url":"https://github.com/aaronmdjones","followers_url":"https://api.github.com/users/aaronmdjones/followers","following_url":"https://api.github.com/users/aaronmdjones/following{/other_user}","gists_url":"https://api.github.com/users/aaronmdjones/gists{/gist_id}","starred_url":"https://api.github.com/users/aaronmdjones/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aaronmdjones/subscriptions","organizations_url":"https://api.github.com/users/aaronmdjones/orgs","repos_url":"https://api.github.com/users/aaronmdjones/repos","events_url":"https://api.github.com/users/aaronmdjones/events{/privacy}","received_events_url":"https://api.github.com/users/aaronmdjones/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-06-13T15:39:16Z","updated_at":"2016-06-13T15:39:16Z","closed_at":null,"body":"The documentation for `mbedtls_ssl_conf_authmode` does not state that a CA chain must be set with `mbedtls_ssl_conf_ca_chain` on the server. If this is not done, mbedTLS will not request a certificate if you set the authmode to `OPTIONAL`.\r\n\r\nHowever, experimentation has determined that you can pass an initialised-but-empty `mbedtls_x509_crt` structure to `mbedtls_ssl_conf_ca_chain` on the server, and it will request and process client certificates as expected.\r\n\r\nI am opening this issue to determine whether this behaviour can be relied upon -- our software wants to unconditionally request client certificates, but it does not verify them, or want the library to verify them -- it only requests them to generate a fingerprint for them. Naturally, having a hardcoded CA certificate in the application is less than ideal, and the server certificate cannot always be used for this purpose instead either.\r\n\r\nOfcourse, the best approach would be to request client certificates if the authmode is set to `OPTIONAL`, regardless of whether a CA chain has been configured or not. Failing that, can we atleast get it documented whether or not an empty `mbedtls_x509_crt` structure (i.e. one passed to `mbedtls_x509_crt_init` and nothing else) is acceptable for `mbedtls_ssl_conf_ca_chain` on the server side? At the moment, that is the case, but you may consider that a bug.\r\n\r\nThanks."}}
{"actor":{"display_login":"aaronmdjones"}}