44 lines
1.5 KiB
Diff
44 lines
1.5 KiB
Diff
From 276698d206e9bad55d628eb2db8a71ba469a2eaf Mon Sep 17 00:00:00 2001
|
|
From: Stephen Gallagher <sgallagh@redhat.com>
|
|
Date: Tue, 22 Apr 2025 13:09:32 -0400
|
|
Subject: [PATCH 4/4] Ensure 'critical' basicConstraint for CA cert
|
|
|
|
Fixes: https://github.com/sgallagher/sscg/issues/74
|
|
|
|
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
|
|
---
|
|
src/authority.c | 3 ++-
|
|
test/test_cert_validity.sh | 2 +-
|
|
2 files changed, 3 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/src/authority.c b/src/authority.c
|
|
index f509fd4316c3b7b230f99de6464491c319fc5d45..68000c5e695460abd65c9641b44c187f4aa617e3 100644
|
|
--- a/src/authority.c
|
|
+++ b/src/authority.c
|
|
@@ -123,7 +123,8 @@ create_private_CA (TALLOC_CTX *mem_ctx,
|
|
sk_X509_EXTENSION_push (ca_certinfo->extensions, ex);
|
|
|
|
/* Mark it as a CA */
|
|
- ex = X509V3_EXT_conf_nid (NULL, NULL, NID_basic_constraints, "CA:TRUE");
|
|
+ ex = X509V3_EXT_conf_nid (
|
|
+ NULL, NULL, NID_basic_constraints, "critical,CA:TRUE");
|
|
CHECK_MEM (ex);
|
|
sk_X509_EXTENSION_push (ca_certinfo->extensions, ex);
|
|
|
|
diff --git a/test/test_cert_validity.sh b/test/test_cert_validity.sh
|
|
index 1e4df5ce57a45981878cec017f710b9699b77c6a..e20e02a384156a1a481e2560308f10a82258986e 100755
|
|
--- a/test/test_cert_validity.sh
|
|
+++ b/test/test_cert_validity.sh
|
|
@@ -204,7 +204,7 @@ key_strength=$(openssl pkey -text -noout -in service-key.pem -passin pass:mypass
|
|
test "$key_strength" -eq "$_arg_key_strength"
|
|
|
|
# Validate the certificates
|
|
-openssl verify -CAfile ca.crt service.pem
|
|
+openssl verify -x509_strict -CAfile ca.crt service.pem
|
|
|
|
popd # $TMPDIR
|
|
|
|
--
|
|
2.49.0
|
|
|