, and jointly announced a new TLS extension (DC), addressing the issues with certificates when providing access to a website through content delivery networks. Certificates issued by certification authorities have a long validity period, which creates difficulties when there is a need to provide access to a site via a third-party service that must establish a secure connection, as sharing the site's certificate with an external service creates additional security risks.
The new extension may also be useful for websites that operate on large distributed infrastructures with many load balancers. Delegated Credentials will eliminate the need to store copies of the private keys of the main certificates on each content delivery node. With the traditional approach, a successful attack on any of the servers involved in delivering HTTPS traffic would compromise the entire certificate. When private keys are shared with content delivery networks, there are risks of data leaks due to sabotage by personnel, actions by security agencies, or compromises within the CDN infrastructure.
If a key leak goes unnoticed, those who gain access to the keys can unobtrusively intercept website traffic for a long time (MITM), as certificate validity periods are measured in months and years. In Cloudflare, specialized key servers can be employed to protect the certificate keys, operating on the website owner's side, but functioning in this mode introduces significant latency in traffic delivery, reduces reliability due to the additional link, and requires the deployment of a complicated infrastructure.
The proposed TLS extension Delegated Credentials introduces an additional intermediate private key whose validity is limited to hours or a few days (no more than 7 days). This key is generated based on the certificate issued by the certification authority and allows the original certificate's private key to remain secret from content delivery services, providing them only with a temporary certificate with a short lifespan.
To avoid access issues after the expiration of an interim key, an automatic renewal technology is provided, executed on the side of the original TLS server. No manual operations or script execution are required for generation — the authorized server that requires the private key contacts the original TLS server of the site before the expiration of the previous key, and it generates an interim key for another short period.
Browsers that support the TLS extension of Delegated Credentials will perceive such derived certificates as trustworthy. For example, support for this extension has already been added in nightly builds and beta versions of Firefox and can be activated in about:config by changing the setting 'security.tls.enable_delegated_credentials'. In mid-November, an experiment is also planned among a certain percentage of users of the test versions of Firefox.As part of which a test request to the Cloudflare DC server will be sent to check the quality of the implementation of the new TLS extension. Support for Delegated Credentials has also been built into the library implementing TLS 1.3.
The Delegated Credentials specification has been submitted to the IETF (Internet Engineering Task Force) committee, which is responsible for the development of Internet protocols and architecture, and is currently at the stage of aspiring to become an internet standard. The Delegated Credentials extension can only be used with TLSv1.3.
To generate interim keys, it is necessary to obtain a TLS certificate that includes a special X.509 extension, which is currently supported only by the DigiCert certificate authority.
Source: opennet.ru
