robinp2000/dachshund-auth-provider
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: bundle GlobalSign Root R46 and R3 as MDS trust anchors instead of downloading one #13

Merged
robinp2000 merged 2 commits from fix/mds-root-certificate into main 2026-10-06 21:06:09 +02:00
Conversation 0 Commits 2 Files changed 6 +389 -55
robinp2000 commented 2026-10-05 12:24:38 +02:00
Owner
Copy link

What

  • Bundle GlobalSign Root R46 and Root CA - R3 (mds/globalsign-root-r46.crt, mds/globalsign-root-r3.crt) as trust anchors for the FIDO MDS blob signature.
  • Remove the download of the root certificate (webauthn.mds.root-cert-url, plain http) and its cache file root-cert.pem.
  • Add optional webauthn.mds.root-cert-path to replace the bundled certificates (DER or PEM, may contain several). A configured but unusable file fails the startup; it never falls back silently.
  • Skip anchors that are expired or not yet valid (with a warning); fail only if none is valid.
  • Log subject, SHA-256 fingerprint and expiry of the anchors in use, and hint in the failure log that the anchors may be outdated.

Why

  • The trust anchor was fetched over http:// on first start: it was only as trustworthy as that connection, and a missing network broke the bean creation.
  • The chain in the current MDS blob is leaf (mds.fidoalliance.org) -> GlobalSign GCC R46 EV TLS CA 2025 -> GlobalSign Root R46, and that last certificate is cross-signed by R3. Java's PKIX validator therefore needs R3 as the anchor today, while FIDO names R46 as the root. Bundling both keeps validation working if FIDO drops the cross-signature. R3 expires on 2029-03-18 and is skipped from then on.

Tests

  • MdsRootCertificatesTest (13 tests): pins the SHA-256 fingerprints of both bundled certificates; DER, PEM and multi-certificate override; a missing, garbage or empty override fails (no silent fallback); expired and not-yet-valid anchors are skipped with a warning; fails if none is valid.
  • Not covered by an automated test: the wiring in PasskeyMDSAuth (MDS is mocked in the integration test).

Notes

  • Breaking: webauthn.mds.root-cert-url is removed. Stale mds-cache/root-cert.pem files can be deleted.
  • Native image: the resources mds/*.crt must be registered for the native build.
## What - Bundle GlobalSign Root R46 and Root CA - R3 (`mds/globalsign-root-r46.crt`, `mds/globalsign-root-r3.crt`) as trust anchors for the FIDO MDS blob signature. - Remove the download of the root certificate (`webauthn.mds.root-cert-url`, plain http) and its cache file `root-cert.pem`. - Add optional `webauthn.mds.root-cert-path` to replace the bundled certificates (DER or PEM, may contain several). A configured but unusable file fails the startup; it never falls back silently. - Skip anchors that are expired or not yet valid (with a warning); fail only if none is valid. - Log subject, SHA-256 fingerprint and expiry of the anchors in use, and hint in the failure log that the anchors may be outdated. ## Why - The trust anchor was fetched over `http://` on first start: it was only as trustworthy as that connection, and a missing network broke the bean creation. - The chain in the current MDS blob is leaf (mds.fidoalliance.org) -> GlobalSign GCC R46 EV TLS CA 2025 -> GlobalSign Root R46, and that last certificate is cross-signed by R3. Java's PKIX validator therefore needs R3 as the anchor today, while FIDO names R46 as the root. Bundling both keeps validation working if FIDO drops the cross-signature. R3 expires on 2029-03-18 and is skipped from then on. ## Tests - `MdsRootCertificatesTest` (13 tests): pins the SHA-256 fingerprints of both bundled certificates; DER, PEM and multi-certificate override; a missing, garbage or empty override fails (no silent fallback); expired and not-yet-valid anchors are skipped with a warning; fails if none is valid. - Not covered by an automated test: the wiring in `PasskeyMDSAuth` (MDS is mocked in the integration test). ## Notes - Breaking: `webauthn.mds.root-cert-url` is removed. Stale `mds-cache/root-cert.pem` files can be deleted. - Native image: the resources `mds/*.crt` must be registered for the native build.
fix: stop downloading the MDS trust anchor over http
All checks were successful
CI / build (pull_request) Successful in 1m56s
Details
35295fe966
robinp2000 deleted branch fix/mds-root-certificate 2026-10-06 21:06:09 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
robinp2000/dachshund-auth-provider!13
No description provided.