Post Reply 
 
Thread Rating:
  • 0 Votes - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
iPXE bundling certificate chains for chainbooting HTTPS resources
2019-11-22, 01:46
Post: #1
iPXE bundling certificate chains for chainbooting HTTPS resources
FYI: I asked this question on StackOverflow: https://stackoverflow.com/questions/5898...-resources because I didn't get the activation email from this forum for an entire day.

According to https://ipxe.org/crypto, by default iPXE trusts its own root certificate located here https://ipxe.org/_media/certs/ca.crt. I tested it it, and I was able to chain boot `https://boot.netboot.xyz` using `chain --autofree https://boot.netboot.xyz`.

I wanted to see if I could use my own custom certificate chain and embed it into iPXE.

To test this, I tried 2 certificates bundles in PEM format. The first is from https://curl.haxx.se/docs/caextract.html. The second is from my OS (NixOS) `cacert` package here https://github.com/NixOS/nixpkgs/blob/ma...efault.nix

In both cases I had a file that was PEM format.

Then I compiled iPXE with the options `CERT=...,TRUST=...`.

Then I tried chain booting into `https://boot.netboot.xyz`. However in both cases, they did not work. It always resulted in http://ipxe.org/err/0216eb.

If I tried instead downloading iPXE's root certificate and explicitly embedding it with `CERT=...,TRUST=...`, the chaining into HTTPs works.

So my questions are:

1. is there a specific format that iPXE requires for its certificate bundles.
2. why do certificate bundles used by curl and other similar applications not work for iPXE
3. how did iPXE's root certificate get cross signed on all of mozilla's public certs?

> This root certificate is used to cross-sign the standard Mozilla list of public CA certificates.
>
> https://ipxe.org/crypto

How did this happen? I would like to reproduce such an activity with my own private CA certificate using `openssl`.
Find all posts by this user
Quote this message in a reply
2019-11-23, 15:26
Post: #2
RE: iPXE bundling certificate chains for chainbooting HTTPS resources
I think there should be a similar question and answer on the mailinglist

mozillas certificates are downloaded, bundled, and signed on ipxe once a month as i remember it.

Read FAQ before first post!
Are relevant ipxe.org error urls and PCIIDs included?
Visit this user's website Find all posts by this user
Quote this message in a reply
2019-12-02, 08:07
Post: #3
RE: iPXE bundling certificate chains for chainbooting HTTPS resources
So disabling OCSP is the solution?

But I'm not actually using my own custom certificate. I'm using the cacert provided to Linux distros, or even curls' certificate distribution. My question, is why these don't work automatically for HTTPs connections.

Do you have a link to the mailing list answer somewhere? I'd like to see how they do that step by step, and compare it to the curl certificate generation process.
Find all posts by this user
Quote this message in a reply
Post Reply 




User(s) browsing this thread: 1 Guest(s)