mTLS client certificate revocation vulnerability with TLS Session Resumption
Apr 3, 2023Rushil Mehra
Summary
Discovered and mitigated a bug where revoked mTLS client certificates were not being blocked during TLS session resumption. The issue stemmed from the client certificate chain not being re-checked during session resumption, leading to bypassed revocation status checks. The immediate mitigation involved disabling session resumption for mTLS connections. A permanent fix was then rolled out to re-enable session resumption by ensuring the leaf certificate serial number and issuer SKI are accessible and checked for revocation status in both session resumption and non-resumption scenarios.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack