mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2026-10-29 02:17:27 +08:00
458fab9987
cert_write signs a certificate with the issuer key without checking that the issuer certificate may issue certificates. A certificate whose basicConstraints extension has cA=FALSE, or whose keyUsage extension does not include keyCertSign, was therefore accepted as a CA. Check the issuer certificate after loading it and reject it when it is explicitly not a CA. Certificates without a basicConstraints extension are still accepted, for compatibility with v1 and v2 certificates, which cannot carry extensions. Fixes #10779. Signed-off-by: akasakariko <148060537+akasakariko@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| cert_app.c | ||
| cert_req.c | ||
| cert_write.c | ||
| CMakeLists.txt | ||
| crl_app.c | ||
| load_roots.c | ||
| req_app.c | ||