Apache WSS4J 1.6.7 features support for specifying constraints on the subject DN of the certificate used for signature validation. This functionality will also be available in the forthcoming Apache CXF 2.6.2, 2.5.5 and 2.4.9 releases.
After a successful signature validation using a certificate referenced in the KeyInfo structure of an XML Signature, the next step is to establish trust in the certificate. The term "direct trust" applies to when the certificate is contained directly in the signature keystore. In this case, certificate constraints are not required as we "directly trust" the certificate. The term "chain trust" refers to when the issuing certificate of the certificate used for signature validation is contained in the signature truststore, and the certificate path of the received certificate is verified.
There is a potential security issue when "chain trust" is applicable. Although the certificate used for signature validation might be "trusted" in a general sense (via a trusted issuing certificate), you may not wish to accept every certificate issued by the trusted certificate. This is particularly relevant if any certificate in your signature
truststore is (or can potentially be) used to issue a wide range of
certificates.
This is where the concept of constraints on the
subject DN of a trusted certificate comes in. The idea is that the user
can specify a list of regular expressions, one of which (note not all)
must be applicable to the subject DN of a (trusted) certificate used for
signature verification. These constraints are not used when the
certificate is contained in the keystore (direct trust). If no cert
constraints are defined, and a successful trust validation is done using
"chain trust", a warning message is logged indicating that a potential security risk exists in signature validaition.
Subject DN Cert Constraints can be configured in WSS4J by specifying a WSHandlerConstants tag, see the WSS4J configuration page for more information. To see this functionality in action take a look at the corresponding WSS4J Unit Test, which uses a cert constraint of ".*CN=Colm.*O=Apache.*". Certificate constraint support can also be enabled in CXF via the endpoint property tag "ws-security.subject.cert.constraints". See the CXF WS-SecurityPolicy for more information.
> These constraints are not used when the certificate
ReplyDelete> is contained in the keystore (direct trust).
Using CXF seems even if the server certificate is in the TLS truststore, subject DN constraints are checked to establish SSL/TLS connection. Not a problem, just have to be aware of it.