sscg/0004-Ensure-critical-basicConstraint-for-CA-cert.patch

44 lines
1.5 KiB
Diff

From 276698d206e9bad55d628eb2db8a71ba469a2eaf Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Tue, 22 Apr 2025 13:09:32 -0400
Subject: [PATCH 4/4] Ensure 'critical' basicConstraint for CA cert
Fixes: https://github.com/sgallagher/sscg/issues/74
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
---
src/authority.c | 3 ++-
test/test_cert_validity.sh | 2 +-
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/src/authority.c b/src/authority.c
index f509fd4316c3b7b230f99de6464491c319fc5d45..68000c5e695460abd65c9641b44c187f4aa617e3 100644
--- a/src/authority.c
+++ b/src/authority.c
@@ -123,7 +123,8 @@ create_private_CA (TALLOC_CTX *mem_ctx,
sk_X509_EXTENSION_push (ca_certinfo->extensions, ex);
/* Mark it as a CA */
- ex = X509V3_EXT_conf_nid (NULL, NULL, NID_basic_constraints, "CA:TRUE");
+ ex = X509V3_EXT_conf_nid (
+ NULL, NULL, NID_basic_constraints, "critical,CA:TRUE");
CHECK_MEM (ex);
sk_X509_EXTENSION_push (ca_certinfo->extensions, ex);
diff --git a/test/test_cert_validity.sh b/test/test_cert_validity.sh
index 1e4df5ce57a45981878cec017f710b9699b77c6a..e20e02a384156a1a481e2560308f10a82258986e 100755
--- a/test/test_cert_validity.sh
+++ b/test/test_cert_validity.sh
@@ -204,7 +204,7 @@ key_strength=$(openssl pkey -text -noout -in service-key.pem -passin pass:mypass
test "$key_strength" -eq "$_arg_key_strength"
# Validate the certificates
-openssl verify -CAfile ca.crt service.pem
+openssl verify -x509_strict -CAfile ca.crt service.pem
popd # $TMPDIR
--
2.49.0