Question

I have an OAuth2 api exposed that runs over HTTPS. Since OAuth2 relies on the security of HTTPS (doesn’t do any of it’s own signing) I added a note in the developer docs encouraging developers to make sure they validate the ssl certificate in their client applications.

I noticed that some apps make the crt file publicly available or include it in their client: https://github.com/stripe/stripe-ruby/tree/master/lib/data

I assume this is just to make sure it is using the right certs (and not any system installed ones)? If so, is it a good idea to make this crt file publicly available to developers on your API page and what is an easy command/way to generate this file?

Thanks!

Answer 1

When one makes the certificate public this way, he encourages clients to do binary comparison of certificates, i.e. validate the certificate not in a way defined by corresponding standards by building a certificate chain and validating them) but simply by comparing the presented certificate with the one stored in the client.

This method is broken in several ways:

1. binary comparison doesn’t let the client know that the certificate was revoked
2. with binary comparison the change of server certificate would require updating all clients so that new certificate would be included there. Failure to upgrade would mean impossibility to connect.

Consequently inclusion of the certificate and “straightforward” use of such certificate makes no sense, neither for server owners nor for clients.

The only case when binary comparison is applicable is when self-signed certificates are used (in which case building and validating a chain won’t work). But self-signed certificates is a bad idea in any case (due to reasons listed above and some other reasons).