Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow validating V3 certificates that have no extensions #241

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Allow validating V3 certificates that have no extensions #241

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
cb22ae9
Do not fail verification for V3 certs with no extensions.
janimo Sep 21, 2021
e837936
Rename error to MalformedExtensions.
janimo Sep 25, 2021
d8f9918
Address PR comments.
janimo Dec 11, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions src/cert.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,12 +95,14 @@ pub(crate) fn parse_cert_internal<'a>(
subject_alt_name: None,
};

// mozilla::pkix allows the extensions to be omitted. However, since
// the subjectAltName extension is mandatory, the extensions are
// mandatory too, and we enforce that. Also, mozilla::pkix includes
// mozilla::pkix allows the extensions to be omitted. It also includes
// special logic for handling critical Netscape Cert Type extensions.
// That has been intentionally omitted.

if tbs.at_end() {
return Ok(cert)
}

der::nested(
tbs,
der::Tag::ContextSpecificConstructed3,
Expand Down
5 changes: 2 additions & 3 deletions tests/cert_without_extensions.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,7 @@ fn cert_without_extensions_test() {
// `openssl x509 -in cert_without_extensions.der -inform DER -text -noout`
const CERT_WITHOUT_EXTENSIONS_DER: &[u8] = include_bytes!("cert_without_extensions.der");

assert_eq!(
Some(webpki::Error::MissingOrMalformedExtensions),
webpki::EndEntityCert::try_from(CERT_WITHOUT_EXTENSIONS_DER).err()
assert!(
webpki::EndEntityCert::try_from(CERT_WITHOUT_EXTENSIONS_DER).is_ok()
);
}