Add optional flags to pass client cert for step certificate inspect #65

Activity

1. sourishkrout

   added

   enhancement

   on Jan 17, 2019
2. sourishkrout

   added

   enhancement

   and removed

   enhancement

   on Feb 5, 2019
3. sourishkrout

   added

   good first issue

   on Jan 29, 2020
4. davidnarayan commented on Dec 8, 2020

   

   davidnarayan

   on Dec 8, 2020

   Contributor

   More actions

   @sourishkrout - I was looking at this and it seems that the client certificate is not required to inspect the peer certificate. The server certificate is sent to the client as part of the ServerHello in the TLS handshake so it's available for inspection irrespective of the client behavior. If the server requires a client certificate, it will fail the TLS handshake, but that's after the certificate exchange.

   I'm curious if you've seen different behavior?

   Here's the test that I did while researching this issue:

   Go server requiring mTLS:

   package main
   
   import (
   	"crypto/tls"
   	"fmt"
   	"log"
   	"net/http"
   	"net/http/httptest"
   )
   
   func main() {
   	ts := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
   		fmt.Fprintln(w, "Hello, client")
   	}))
   	defer ts.Close()
   
   	ts.TLS = &tls.Config{
   		ClientAuth: tls.RequireAnyClientCert,
   	}
   
   	ts.StartTLS()
   	fmt.Println("Listening on: ", ts.URL)
   	select {}
   }

   Start the server:

   ❯ go run testserver.go
   Listening on:  https://127.0.0.1:54371
   

   Run step to inspect the certificate:

   ❯ step certificate inspect https://127.0.0.1:54371 -insecure -short
   X.509v3 Root CA Certificate (RSA 1024) [Serial: 6448...4187]
     Subject:     example.com
                  127.0.0.1
                  ::1
     Issuer:
     Valid from:  1970-01-01T00:00:00Z
             to:  2084-01-29T16:00:00Z
   

   Note that the server logged an error message because the client didn't provide a certificate:

   2020/12/08 09:42:09 http: TLS handshake error from 127.0.0.1:54380: tls: client didn't provide a certificate
   

   However, the peer certificate inspection still completed.

   Are there perhaps other use cases or different behaviors that you've observed with other TLS servers?
5. isodude commented on Apr 24, 2025

   

   isodude

   on Apr 24, 2025

   Contributor

   More actions

   I wanted this the other day when I was troubleshooting why my client certificate was not working.
   As such, is not the peer certificate that is interesting, but rather validating the client certificate with the peer certificate.
6. hslatman commented on Apr 24, 2025

   

   hslatman

   on Apr 24, 2025

   Member

   More actions

   @isodude this might (soon) be of use: #1402