coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-10-28 18:07:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge 458fab99875ba83ce9bcf65d29c4c017bc993be7 into 03e1438089654fb884ac48e0f3cd0049cfe2c102

Browse Source
This commit is contained in:
Asuka 2026-10-27 10:46:03 -04:00 committed by GitHub
commit d16d687c18
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 46 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ChangeLog.d/cert-write-issuer-not-ca.txt Normal file
View File

@ -0,0 +1,6 @@
Bugfix
* Fix the `cert_write` sample program accepting an issuer certificate
that is not allowed to issue certificates. A certificate whose
basicConstraints extension has cA=FALSE, or whose keyUsage extension
does not include keyCertSign, is now rejected instead of being used to
sign a certificate. Fixes #10779.

40
programs/x509/cert_write.c
View File

@ -294,6 +294,40 @@ static int parse_serial_decimal_format(unsigned char *obuf, size_t obufmax,
return 0;
}
/*
* Check that a certificate may be used to issue other certificates.
*
* RFC 5280 section 4.2.1.9 requires a CA certificate to have the
* basicConstraints extension with cA set to TRUE, and section 4.2.1.3
* requires the keyCertSign bit to be set in the keyUsage extension of a
* certificate that signs certificates, if that extension is present.
*
* Certificates without a basicConstraints extension are accepted so that
* v1 and v2 certificates, which cannot carry extensions, keep working.
*
* This prints the reason for a rejection. Return 0 if the certificate may
* be used to issue certificates, or -1 otherwise.
*/
static int check_issuer_can_sign(const mbedtls_x509_crt *issuer_crt)
{
if (mbedtls_x509_crt_get_ca_istrue(issuer_crt) == 0) {
mbedtls_printf(" failed\n ! the issuer certificate is not a CA: "
"the basicConstraints extension has cA=FALSE\n\n");
return -1;
}
if (mbedtls_x509_crt_has_ext_type(issuer_crt, MBEDTLS_X509_EXT_KEY_USAGE) &&
mbedtls_x509_crt_check_key_usage(issuer_crt,
MBEDTLS_X509_KU_KEY_CERT_SIGN) != 0) {
mbedtls_printf(" failed\n ! the issuer certificate cannot sign "
"certificates: the keyUsage extension does not have "
"keyCertSign\n\n");
return -1;
}
return 0;
}
int main(int argc, char *argv[])
{
int ret = 1;
@ -793,6 +827,12 @@ usage:
opt.issuer_name = issuer_name;
/* Refuse to issue a certificate from a certificate that is not
* allowed to sign certificates. */
if (check_issuer_can_sign(&issuer_crt) != 0) {
goto exit;
}
mbedtls_printf(" ok\n");
}