search

OpenVPN / easy-rsa

easy-rsa - Simple shell based CA utility
Other
4.05k stars 1.2k forks source link

Make keyUsage critical in code-signing #1062

Closed eds-collabora closed 10 months ago

eds-collabora commented 10 months ago

This is required, as described in:

"Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server certificates v2.0.2", CA/Browser Forum.

See in particular table 7.1.3.2.1 where keyUsage is marked CRITICAL.

This change is required for easy-rsa certificates to be passed as valid code-signing certificates by OpenSSL 3.2.0, which gives the above as its source.

TinCanTech commented 10 months ago

@eds-collabora Thanks for this PR.

Changing attributes in the x509-types files has been discussed before and the bottom line is, Easy-RSA is not going to change the x509-types files, at this time.

However, there is now a different approach which can be explored, using temp-files, that I may look into.

TinCanTech commented 9 months ago

1063