mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2026-11-12 09:24:15 +08:00
458fab9987
cert_write signs a certificate with the issuer key without checking that the issuer certificate may issue certificates. A certificate whose basicConstraints extension has cA=FALSE, or whose keyUsage extension does not include keyCertSign, was therefore accepted as a CA. Check the issuer certificate after loading it and reject it when it is explicitly not a CA. Certificates without a basicConstraints extension are still accepted, for compatibility with v1 and v2 certificates, which cannot carry extensions. Fixes #10779. Signed-off-by: akasakariko <148060537+akasakariko@users.noreply.github.com>
7 lines
337 B
Plaintext
7 lines
337 B
Plaintext
Bugfix
|
|
* Fix the `cert_write` sample program accepting an issuer certificate
|
|
that is not allowed to issue certificates. A certificate whose
|
|
basicConstraints extension has cA=FALSE, or whose keyUsage extension
|
|
does not include keyCertSign, is now rejected instead of being used to
|
|
sign a certificate. Fixes #10779.
|