Context/discussion: https://discord.com/channels/943670759891554316/1509120535223603381
joachim beckers
I've added a "semi" self-signed certificate to the tls-manager-plugin on my server. The certificate has a valid chain, i.e. one (self-signed) issuing CA and one (self-signed) Root CA.
Clients trust the Root CA via a modified cacerts file.
The cacerts does not contain the Issuing CA.
Connections fail. A coworker found out the reason is that mirth doesn't send the whole cert chain, only the server cert.
That tracks; the tls-manager UI only lets me import the server cert pem, not the full chain pem.
Devs can connect with a test client using startup param -Dcom.sun.security.enableAIAcaIssuer=true, but due to firewall config, the AIA x509 extension is not usable in prod.
Now I'm wondering what my options are. Should I just add the Issuing CA to the client cacerts?,
Copilot tells me to add the Root and Issuing CA certs to the Additional Trusted Certificates. I'll try, but my guess is this won't make a difference. Additional Trusted Certificates feels like it's only applicable when mirth is the client, but in my case it's the server
cgibson
Good find and can see this being a valid issue. I don't believe this is an TLS RFC non-complaint server/failure though... pbrichardson (NovaMap) / Paul Hristea (NovaMap) will defer to you guys.
I'll check today to see how the NG plugin functions as that's obviously a good parallel. I kinda suspect it works the same
Shouldn't expect a client to have arbitrary intermediates
Nor do I think clients will chase AIA
pbrichardson
Joachim Beckers Thanks for checking out the TLS Manager. Would you mind raising a GH issue please, then we can schedule someone to take a look at it. Based on what I know, I don't think it represents a bug, but you're not going to be the last to encounter this situation, so I'd like to make sure that our guidance is documented. If it does turn out to be a bug, then we would want a GH issue anyway. Thanks very much.
Context/discussion: https://discord.com/channels/943670759891554316/1509120535223603381
joachim beckers
cgibson
pbrichardson