1
$\begingroup$

I'm currently working on Timestamping and stumbled upon a parameter fRequestCerts/requestSignerCertificates/certReq that according to the documentation (1, 2) tells a TSA to include the certificate that was used to sign the timestamp token in its response.

When fiddling with this parameter I noticed that Windows behaves differently when validating self-signed TSA certificates. More specifically, when the parameter is set to true Windows apparently treats self-signed TSA certificates as trustworthy. When the parameter is set to false Windows treats them as non-trustworthy.

Unfortunately I couldn't find any more detailed information about this matter. So my questions are:

  • Why exactly would I use this parameter?
  • How does it influence trust?
Improve this question
$\endgroup$

1 Answer 1

Reset to default
0
$\begingroup$

The behavior turned out to be a vulnerability. Details about it can be found here https://about.signpath.io/blog/2020/08/26/on-the-importance-of-trust-validation.html.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.