RFC 7633

X.509v3 Transport Layer Security (TLS) Feature Extension

📅 published October 2015, from ietf

X.509v3 Transport Layer Security (TLS) Feature Extension ✨

okay bestie, this is RFC 7633 🎀 It's from the Internet Engineering Task Force (IETF), written by P. Hallam-Baker at Comodo Group Inc. 💅 It's a Standards Track doc, dated October 2015, with ISSN 2070-1721. The title block doesn't list anything it obsoletes or updates, so there's nothing to cross-check there 🦋

Abstract 🌸

The whole point of the TLS feature extension is to stop downgrade attacks that the TLS protocol can't stop on its own 🛡️ It can be used to require support for revocation checking features, like OCSP stapling. If clients are told that an OCSP status response will always be stapled, they can fail right away when it isn't. That stops a denial-of-service attack that might otherwise be possible 💀

Status of This Memo 📜

This is an Internet Standards Track document.

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). More info on Internet Standards is in Section 2 of RFC 5741.

For info on the current status of this document, any errata, and how to give feedback on it, check http://www.rfc-editor.org/info/rfc7633 ✨

Copyright Notice ©

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

Table of Contents 📖

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
2.  Definitions . . . . . . . . . . . . . . . . . . . . . . . . .   2
  2.1.  Requirements Language . . . . . . . . . . . . . . . . . .   2
  2.2.  TLS Feature, X.509 Extension  . . . . . . . . . . . . . .   3
3.  Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . .   3
4.  Syntax  . . . . . . . . . . . . . . . . . . . . . . . . . . .   4
  4.1.  TLS Feature . . . . . . . . . . . . . . . . . . . . . . .   4
  4.2.  Use . . . . . . . . . . . . . . . . . . . . . . . . . . .   5
    4.2.1.  Certificate Signing Request . . . . . . . . . . . . .   5
    4.2.2.  Certificate Signing Certificate . . . . . . . . . . .   5
    4.2.3.  End-Entity Certificate  . . . . . . . . . . . . . . .   5
  4.3.  Processing  . . . . . . . . . . . . . . . . . . . . . . .   6
    4.3.1.  Certification Authority . . . . . . . . . . . . . . .   6
    4.3.2.  Server  . . . . . . . . . . . . . . . . . . . . . . .   7
    4.3.3.  Client  . . . . . . . . . . . . . . . . . . . . . . .   7
5.  Security Considerations . . . . . . . . . . . . . . . . . . .   7
  5.1.  Alternative Certificates and Certificate Issuers  . . . .   7
  5.2.  Denial of Service . . . . . . . . . . . . . . . . . . . .   8
  5.3.  Cipher Suite Downgrade Attack . . . . . . . . . . . . . .   8
6.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   8
7.  Normative References  . . . . . . . . . . . . . . . . . . . .   9
Appendix A.  ASN.1 Module . . . . . . . . . . . . . . . . . . . .  10
Acknowledgements  . . . . . . . . . . . . . . . . . . . . . . . .  11
Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .  11

1. Introduction ✨

The Transport Layer Security (TLS) feature extension gives you a way to prevent downgrade attacks that the TLS protocol can't prevent by itself 🔐

The TLS protocol already does a great job against most kinds of downgrade attack, including attacks on the cipher suite choices offered and on client credentials. So the TLS feature extension only matters for validating TLS protocol credentials 💅

2. Definitions 🎀

2.1. Requirements Language 📝

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119].

2.2. TLS Feature, X.509 Extension 🦋

To avoid confusion, the word "extension" in this doc is saved for X.509v3 extensions. When we say "TLS feature extension," we mean what the TLS specification [RFC5246] calls an "extension" 🧚

3. Purpose 💜

Right now, the only TLS feature extensions that matter for the revocation status of credentials are the Certificate Status Request extension (status_request) and the Multiple Certificate Status Extension (status_request_v2). They support in-band exchange of Online Certificate Status Protocol (OCSP) tokens, also known as OCSP stapling. These extensions are described in [RFC6066] and [RFC6961] 🌈

The OCSP stapling mechanism in [RFC6066] lets a TLS server show evidence of valid certificate status in-band. When that info arrives in-band, the privacy, performance, and reliability headaches of making a third-party connection during the TLS handshake are gone ✨ But a client can't conclude anything from missing in-band status info unless it knows the legitimate server would have sent it. The status info could be missing because the server doesn't support the extension, or because the server is withholding it on purpose, knowing the certificate is invalid 🙈

Including a TLS feature extension that advertises the status_request feature in the server end-entity certificate lets a client fail immediately if the server doesn't provide certificate status info. The need to query the OCSP responder is gone entirely. That makes things more efficient for the client and, more importantly, stops a denial-of-service attack against the client, whether an attacker blocks the OCSP response or mounts a denial-of-service attack against the OCSP responder 😭

Since the TLS feature extension is an option, an attacker trying to get a certificate through fraud probably won't ask for one with this extension. Those risks are better handled by mechanisms like Certification Authority Authorization DNS records [RFC6844], which are designed to prevent or mitigate mis-issue 💅

A server offering an end-entity certificate with a TLS feature extension MUST satisfy a client request for the specified feature, unless that would be redundant as described below. Clients MAY refuse to accept the connection if the server doesn't accept a request for a specified feature 🔥

A Certification Authority SHOULD NOT issue certificates that specify a TLS feature extension advertising features that the server doesn't support 🚫

A server MAY advise a Certification Authority that it is capable of supporting a feature, by including the corresponding TLS feature extension in a Certificate Signing Request [RFC2986]. A server SHOULD verify that its configuration supports the features advertised in the credentials it presents to a client requesting a connection 👑

This document describes how the TLS feature is used in PKIX end-entity certificates and Certificate Signing Certificates. It also provides a mechanism that MAY be used to describe support for the specified features in-band, for the most commonly used certificate registration protocol 🍓

4. Syntax 🧩

See Appendix A for an ASN.1 module

The TLS feature extension has the following format:

id-pe-tlsfeature OBJECT IDENTIFIER ::=  { id-pe 24 }

Features ::= SEQUENCE OF INTEGER

The extnValue of the id-pe-tlsfeature extension is the ASN.1 DER encoding of the Features structure 🌸

The TLS feature extension SHOULD NOT be marked critical. RFC 5280 [RFC5280] requires that implementations that don't understand critical extensions MUST reject the certificate. Marking the TLS feature extension critical breaks backward compatibility, and it is not recommended unless that's the behavior you actually want 😭

4.1. TLS Feature 🎀

The object member "Features" is a sequence of TLS extension identifiers (features, in this specification's terminology) from the IANA Transport Layer Security (TLS) Extensions registry. If the client requests these features in its ClientHello message, then the server MUST return a ServerHello message that satisfies that request 🫶

This specification doesn't require a TLS client to offer or support any TLS feature, whether or not it's specified in the server certificate's TLS feature extension. In particular, a client MAY request, and a server MAY support, any TLS extension whether or not it's specified in a TLS feature extension 🦋

A server that offers a certificate containing a TLS feature extension MUST support the features specified and comply with the corresponding requirements. Main character server energy 👑

4.2. Use 💅

4.2.1. Certificate Signing Request 📨

If the certificate issuance mechanism uses the PKCS #10 Certificate Signing Request (CSR) [RFC2986], the CSR MAY specify a TLS feature extension as a CSR Attribute, as defined in Section 4.1 of [RFC2986]. A server or server administration tool should only generate key signing requests it knows the server for which the certificate is intended can support 🧁

4.2.2. Certificate Signing Certificate 🔐

When a TLS feature extension is present in a Certificate Signing Certificate (i.e., a Certification Authority certificate with the key usage extension value set to keyCertSign), it sets a constraint on valid certificate chains. Specifically, a certificate signed by a Certificate Signing Certificate that contains a TLS feature extension MUST contain a TLS feature extension offering the same set of features, or a superset of them, as the signing certificate advertises 🌈

This gives you a way to require support for a particular set of features for certificates issued under a given Certificate Signing Certificate, without TLS clients having to check TLS feature extensions across multiple certificates. Iconic efficiency 🙌

4.2.3. End-Entity Certificate 🌟

When a TLS feature extension is specified in a server end-entity certificate (i.e., a certificate that specifies the id-kp-serverAuth Extended Key Usage (EKU)), it lays out criteria that a server MUST meet to be compliant with the feature declaration 📜

If a client determines that the server configuration is inconsistent with the specified feature declaration, it MAY reject the TLS configuration 🚨

4.2.3.1. TLS status_request ✨

Okay so, if a client figures out that the server config doesn't match a feature declaration saying it supports the TLS status_request extension, it SHOULD reject the TLS configuration. 🙅‍♀️

A client MAY accept the config anyway if it can still prove the certificate chain is valid some other way (like grabbing the OCSP data from a different source) 🧚

Real talk: sometimes the other option is sending the same info with zero security at all 💀 So a client MAY accept a TLS config even though it doesn't match the TLS feature declaration, but it MUST NOT label that connection as secure. 🔒

4.3. Processing 🌸

Advertising a TLS feature extension can change what relying parties expect. If those expectations aren't met, a perfectly valid certificate might get rejected as invalid 😭 Particular attention is required at the start of a certificate lifecycle. A server won't be able to comply with a TLS feature extension if the certificate gets issued and released to the subject before the matching status token is published.

4.3.1. Certification Authority 👑

A Certification Authority SHOULD NOT issue certificates with a TLS feature extension unless there's an affirmative statement that the end entity intends to support the specified features (for example, the use of a feature extension in the CSR or through an out-of-band communication). Main character energy: the CA checks first 💅

A Certification Authority SHOULD ensure that the certificate provisioning process for certificates containing a TLS feature extension lets the certificate subject meet the requirements (for example, making sure OCSP tokens are published before the corresponding certificate is released to the subscriber). ✨

4.3.2. Server 🖥️

A TLS server certificate containing a TLS feature extension MAY be used with any TLS server that supports the specified features. The server doesn't have to support the TLS feature extension itself 🙈 Such support is nevertheless desirable, since it can reduce the risk of administrative error.

A server SHOULD verify that its configuration is compatible with the TLS feature extension expressed in a certificate it presents. When an existing certificate is being replaced by a new one, the server SHOULD NOT start using the new certificate until the necessary OCSP status token or tokens are available. Patience is a virtue, bestie 🫶

A server MAY override local configuration options if necessary to ensure consistency, but it SHOULD inform the administrator whenever such an inconsistency is discovered. 📣

A server SHOULD support generation of the feature extension in CSRs if key generation is supported. 🎀

4.3.3. Client 💜

A client MUST treat a certificate with a TLS feature extension as an invalid certificate if the features offered by the server do not contain all features present in both the client's ClientHello message and the TLS feature extension. No exceptions, iconic behaviour 👑

In the case that use of TLS with a valid certificate is mandated by explicit security policy, application protocol specification, or other means, the client MUST refuse the connection. If the use of TLS with a valid certificate is optional, a client MAY accept the connection but MUST NOT treat the certificate as valid. 🦋

5. Security Considerations 🔐

5.1. Alternative Certificates and Certificate Issuers

Using the TLS feature extension to mandate a particular form of revocation checking is optional 🌈 This control protects you in the case that a certificate with a TLS feature gets compromised after it's issued, but it does not protect you if an attacker gets an unmarked certificate from an issuer through fraud. 😱

The TLS feature extension is a post-issue security control. Risks like that can only be handled by security controls that take effect before issue. Prevention is the move 🛡️

5.2. Denial of Service 🚫

A certificate issuer could issue a certificate that intentionally specified a feature statement they knew the server couldn't support. ngl, that's a scary thought 💀

The consequences of that refusal would appear to be limited, since a Certification Authority could equally refuse to issue the certificate in the first place. ✨

5.3. Cipher Suite Downgrade Attack ⬇️

The TLS feature extension does not provide protection against a cipher suite downgrade attack. That job is left to the existing controls in the TLS protocol itself 💅

6. IANA Considerations 📋

IANA has added the following entry in the "SMI Security for PKIX Certificate Extension" (1.3.6.1.5.5.7.1) registry:

Decimal  Description                     References
-------  ------------------------------  ---------------------

  24     id-pe-tlsfeature                this document (RFC 7633)

IANA has added the following entry in the "SMI Security for PKIX Module Identifier" (1.3.6.1.5.5.7.0) registry:

Decimal  Description                     References
-------  ------------------------------  ---------------------

  86     id-mod-tls-feature-2015         this document (RFC 7633)

7. Normative References 📚

Here are all the references, every detail included 💖

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <http://www.rfc-editor.org/info/rfc2119>.

[RFC2986]  Nystrom, M. and B. Kaliski, "PKCS #10: Certification
           Request Syntax Specification Version 1.7", RFC 2986,
           DOI 10.17487/RFC2986, November 2000,
           <http://www.rfc-editor.org/info/rfc2986>.

[RFC5246]  Dierks, T. and E. Rescorla, "The Transport Layer Security
           (TLS) Protocol Version 1.2", RFC 5246,
           DOI 10.17487/RFC5246, August 2008,
           <http://www.rfc-editor.org/info/rfc5246>.

[RFC5280]  Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
           Housley, R., and W. Polk, "Internet X.509 Public Key
           Infrastructure Certificate and Certificate Revocation List
           (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008,
           <http://www.rfc-editor.org/info/rfc5280>.

[RFC6066]  Eastlake 3rd, D., "Transport Layer Security (TLS)
           Extensions: Extension Definitions", RFC 6066,
           DOI 10.17487/RFC6066, January 2011,
           <http://www.rfc-editor.org/info/rfc6066>.

[RFC6844]  Hallam-Baker, P. and R. Stradling, "DNS Certification
           Authority Authorization (CAA) Resource Record", RFC 6844,
           DOI 10.17487/RFC6844, January 2013,
           <http://www.rfc-editor.org/info/rfc6844>.

[RFC6961]  Pettersen, Y., "The Transport Layer Security (TLS) Multiple
           Certificate Status Request Extension", RFC 6961,
           DOI 10.17487/RFC6961, June 2013,
           <http://www.rfc-editor.org/info/rfc6961>.

Appendix A. ASN.1 Module 🧚

Here's the ASN.1 module, copied exactly 🎀

TLS-Feature-Module-2015 {
    iso(1) identified-organization(3) dod(6) internet(1)
    security(5) mechanisms(5) pkix(7) id-mod(0)
    id-mod-tls-feature-2015(86)}

DEFINITIONS IMPLICIT TAGS ::=
BEGIN

    IMPORTS -- From RFC 5912

    id-pe
    FROM PKIX1Explicit-2009 {
        iso(1) identified-organization(3) dod(6) internet(1)
        security(5) mechanisms(5) pkix(7) id-mod(0)
        id-mod-pkix1-explicit-02(51)}

    EXTENSION
    FROM PKIX-CommonTypes-2009 {
        iso(1) identified-organization(3) dod(6) internet(1)
        security(5) mechanisms(5) pkix(7) id-mod(0)
        id-mod-pkixCommon-02(57)}
    ;

    CertExtensions EXTENSION ::= {
        ext-TLSFeatures, ... }

        -- TLS Features Extension

    ext-TLSFeatures EXTENSION ::= { SYNTAX
        Features IDENTIFIED BY id-pe-tlsfeature }

    id-pe-tlsfeature OBJECT IDENTIFIER ::= { id-pe 24 }

    Features ::= SEQUENCE OF INTEGER

END

Acknowledgements 🫶

This proposal pulls in text and other contributions from people in the IETF and CA-Browser forum, shoutout to Robin Alden, Richard Barnes, Viktor Dukhovni, Stephen Farrell, Gervase Markham, Yoav Nir, Tom Ritter, Jeremy Rowley, Stefan Santesson, Ryan Sleevi, Brian Smith, Rob Stradling, and Sean Turner 💜 They're all iconic.

Author's Address 💌

Phillip Hallam-Baker
Comodo Group Inc.

Email: philliph@comodo.com

📦 where this page comes from

ietf: rfc7633 2015-10
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms