Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Client certificate support is broken #62

Open
djones6 opened this issue May 10, 2019 · 1 comment
Open

Client certificate support is broken #62

djones6 opened this issue May 10, 2019 · 1 comment

Comments

@djones6
Copy link
Contributor

djones6 commented May 10, 2019

Support for client certificate authentication (2-way SSL) was supposedly introduced in #33, but I believe it is broken. There is a test for this, but the test does not access an endpoint that requests a client certificate.

There are obvious errors in the code which mean it won't work. For example:
https://github.com/IBM-Swift/SwiftyRequest/blob/master/Sources/SwiftyRequest/RestRequest.swift#L930

                // Read the certificate data from disk
                if let key = NSData(base64Encoded: path) {

At first glance this looks reasonable, but NSData(base64Encoded:) tries to base64decode a String, it does not read from a file. This will fail, because it's being provided a file path and not its contents.

Also, if it were given the content of the file, there is no file format that you could straight decode as base64 - as I understand it, raw DER is binary data, and PEM is base64-encoded DER plus some human-readable headers. We'd need to remove those headers to decode the data. I'm not convinced that the code within this block has ever been executed, however it looks convincing (speaking as someone who doesn't understand it), so it may have come from somewhere authoritative, and may work if the problems above are addressed.

@djones6
Copy link
Contributor Author

djones6 commented May 13, 2019

I've pushed the debugging I've done up to this point to this branch: https://github.com/IBM-Swift/SwiftyRequest/compare/clientCertFixes

I was planning to use a service hosted on badssl.com that allows you to download a client certificate (https://badssl.com/download/) and then supply it for verification at https://client.badssl.com/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant