GoAhead can still trust revoked client certificates
FoxIO researcher Sébastien Féry disclosed three TLS flaws in EmbedThis GoAhead on October 26, including one that lets revoked client certificates authenticate on a specifically configured OpenSSL mutual-TLS server. EmbedThis says GoAhead 6.1.1 fixes the issues.
In mutual TLS, the client and server authenticate each other. On the affected path, GoAhead loads the certificate revocation list—the list meant to invalidate certificates—but fails to enable the check that consults it. A revoked client certificate can therefore complete login and receive whatever access its identity allows. The bypass requires OpenSSL, required client certificates, issuer checking, and a configured revocation list; Mbed TLS builds are unaffected.
For device makers using that combination on router, gateway, printer, or controller management interfaces, revoking a device identity may not remove its access until the fixed server version is in place. The disclosure does not establish how many deployments use this specific configuration.