Registration: handle certificates without Client Auth in EKU #130

New issue

Open

opened 2026-02-20 19:14:41 -05:00 by deekerman · 0 comments

deekerman commented

2026-02-20 19:14:41 -05:00

Owner

Originally created by @mkrautz on GitHub (Dec 15, 2013).

When a server registers with the Mumble public server list's master server, the server uses its certificate as a client certificate.

Some certificates, such as StartCom's Class 1 Server Certificates (the free ones), do not have Client Authentication set in their Extended Key usage.

This causes the registration TLS handshake to fail. The registration server is a Perl script sitting behind mod_perl, so the entity responsible for the handshake is Apache.

Modifying Apache to fit our use-case seems to be a big maintenance burden.

Perhaps we should detect whether the Client Auth EKU is present in the server's certificate, and if that's the case, we could generate an ephemeral "container" X.509 certificate, containing the server's real certificate chain in extension (or similar mechansim).

This certficiate would be generated each time a registration happens.

Suggestions welcomed.

Originally created by @mkrautz on GitHub (Dec 15, 2013). When a server registers with the Mumble public server list's master server, the server uses its certificate as a client certificate. Some certificates, such as StartCom's Class 1 Server Certificates (the free ones), do not have Client Authentication set in their Extended Key usage. This causes the registration TLS handshake to fail. The registration server is a Perl script sitting behind mod_perl, so the entity responsible for the handshake is Apache. Modifying Apache to fit our use-case seems to be a big maintenance burden. Perhaps we should detect whether the Client Auth EKU is present in the server's certificate, and if that's the case, we could generate an ephemeral "container" X.509 certificate, containing the server's real certificate chain in extension (or similar mechansim). This certficiate would be generated each time a registration happens. Suggestions welcomed.