<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=gb2312"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="EN-US" link="#0563C1" vlink="#954F72"> <div class="WordSection1"> Yes<o:p></o:p> <o:p> </o:p> <div> Best Regards<o:p></o:p> Siyuan <o:p></o:p> </div> <o:p> </o:p> <div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt"> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm"> <a name="_____replyseparator"></a>From: Sivaraman Nainar <sivaramann@amiindia.co.in> Sent: 2019年12月27日 15:26 To: Fu, Siyuan <siyuan.fu@intel.com>; devel@edk2.groups.io; Wu, Jiaxin <jiaxin.wu@intel.com> Cc: Madhan B. Santharam <madhans@ami.com>; Arun Subramanian B <arunsubramanianb@ami.com>; Arun Sura Soundara Pandian <arunsuras@amiindia.co.in>; Bhuvaneshwari M R <bhuvaneshwarimr@amiindia.co.in>; Ramesh R. <rameshr@ami.com> Subject: RE: HTTPS Certificate Validation During Enrollment<o:p></o:p> </div> </div> <o:p> </o:p> Siyuan:<o:p></o:p> <o:p></o:p> I agree. The basic check whatever we are doing here is the file extension only. Do you mean that could be enough and TLS will take care of validating the certificate during the connection State?<o:p></o:p> <o:p></o:p> -Siva<o:p></o:p> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm"> From: Fu, Siyuan [<a href="mailto:siyuan.fu@intel.com">mailto:siyuan.fu@intel.com</a>] Sent: Tuesday, December 24, 2019 1:30 PM To: Sivaraman Nainar; <a href="mailto:devel@edk2.groups.io">devel@edk2.groups.io</a>; Wu, Jiaxin Cc: Madhan B. Santharam; Arun Subramanian B; Arun Sura Soundara Pandian; Bhuvaneshwari M R; Ramesh R. Subject: RE: HTTPS Certificate Validation During Enrollment<o:p></o:p> </div> </div> <o:p></o:p> Hi, Siva<o:p></o:p> <o:p></o:p> We don’t think this is a real problem. The cert is saved as NV variable just like any other EFI variables, there are some basic checks like verify it’s a valid DER-encoded certificate before saving the certificate, and TLS config driver also provides a page to allow user to delete unused cert from system.<o:p></o:p> <o:p></o:p> If someone want to fill the NV variable storage full with garbage, they can simply use SetVaraible service, not necessary to use this page. <o:p></o:p> <o:p></o:p> <div> Best Regards<o:p></o:p> Siyuan <o:p></o:p> </div> <o:p></o:p> <div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt"> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm"> From: Sivaraman Nainar <<a href="mailto:sivaramann@amiindia.co.in">sivaramann@amiindia.co.in</a>> Sent: 2019年12月24日 13:17 To: <a href="mailto:devel@edk2.groups.io">devel@edk2.groups.io</a>; Wu, Jiaxin <<a href="mailto:jiaxin.wu@intel.com">jiaxin.wu@intel.com</a>>; Fu, Siyuan <<a href="mailto:siyuan.fu@intel.com">siyuan.fu@intel.com</a>> Cc: Madhan B. Santharam <<a href="mailto:madhans@ami.com">madhans@ami.com</a>>; Arun Subramanian B <<a href="mailto:arunsubramanianb@ami.com">arunsubramanianb@ami.com</a>>; Arun Sura Soundara Pandian <<a href="mailto:arunsuras@amiindia.co.in">arunsuras@amiindia.co.in</a>>; Bhuvaneshwari M R <<a href="mailto:bhuvaneshwarimr@amiindia.co.in">bhuvaneshwarimr@amiindia.co.in</a>>; Ramesh R. <<a href="mailto:rameshr@ami.com">rameshr@ami.com</a>> Subject: reg: HTTPS Certificate Validation During Enrollment<o:p></o:p> </div> </div> <o:p></o:p> Hello all:<o:p></o:p> <o:p></o:p> Right now the HTTPS Certificates are getting validated during TlsConfigCertificate()by HTTPDxe Driver.<o:p></o:p> <o:p></o:p> But during enrollment of certificate via TLSDXE driver, it does not have any validation and it keep appending the TLSCaCert variable with the certificate provided.<o:p></o:p> <o:p></o:p> Assume an invalid certificate keep loaded via TLS Auth configuration page, the NVRAM would be filled with garbage.<o:p></o:p> <o:p></o:p> Is there any plan to have certificate validation during Enrollment?<o:p></o:p> <o:p></o:p> -Siva<o:p></o:p> </div> </div> </div> </body> </html> <div width="1" style="color:white;clear:both">_._,_._,_</div> <hr> Groups.io Links: You receive all messages sent to this group. <a target="_blank" href="https://edk2.groups.io/g/devel/message/52588">View/Reply Online (#52588)</a> | | <a target="_blank" href="https://groups.io/mt/69246372/1813853">Mute This Topic</a> | <a href="https://edk2.groups.io/g/devel/post">New Topic</a> <a href="https://edk2.groups.io/g/devel/editsub/1813853">Your Subscription</a> | <a href="mailto:devel+owner@edk2.groups.io">Contact Group Owner</a> | <a href="https://edk2.groups.io/g/devel/unsub">Unsubscribe</a> [edk2-devel-archive@redhat.com] <div width="1" style="color:white;clear:both">_._,_._,_</div>