FreeTDS Development Group

[Peter Deacon <peterd AT iea-software.com>]

On Mon, 6 Apr 2015, Frediano Ziglio wrote:

> Hi,
>  this is my last stopover before release. I wrote a patch to start
> doing certificate verification, see
> https://github.com/freddy77/freetds/commit/557caf0e0af1c385d6cfd1602f593f9683ed6fc8.
>
> Now the problem is when to check. If a mssql is installed without
> certificate a dummy certificate (self signed with a
> "Self_Signed_Fallback" common name) is generate every time the sql
> instance is started (not during the install so you cannot cache the
> certificate of a given server). So there is no way to check these
> certificates, FreeTDS (and MSSQL driver too) has to accept by default
> these certificates.
> The patch add two options to freetds.conf, "ca file" and "crl file",
> respectively the file containing the root authorities and the
> certificates revocation list (list of certificates to not accept). So
> the key of the patch is: if you specify CA list you want to check
> certificate, if not accept any certificates sent. Now, the questions
> are:

> - should FreeTDS check the common name (with server name inside) of
> the certificate?

Important if a global CA is used.  Without checking an attacker can buy a 
cert from that CA and compromise security.

Might also be important for company-wide CAs.  Company might hand out a 
cert for a test server in a satellite office that compromises an important 
production server without the name checking.

Ususally hostname TDS is using (e.g. sqlserver.mydomain.com) would match 
CN of servers public key.

In OpenSSL after you SSL_accept connection fetching CN might look 
something like:

peer = SSL_get_peer_certificate(myconnection);
X509_NAME_get_text_by_NID(X509_get_subject_name(peer),NID_commonName,output_cn_goes_here...)
X509_free(peer);


Sometimes CN can contain wildcards *.mydomain.com or additional valid 
hosts present in subject alternate name attributes of servers public key.. 
not sure either is needed/useful here.

> - should I add an option to disable name verification?

> - should I read system CA list so to check the global list installed
> in the system? I don't know if this is useful, are mssql with proper
> certificate using a public CA?

Dunno might be useful for someone connecting to a commercially hosted 
server..?

Have Fun!
Peter