search

zmap / zlint

X.509 Certificate Linter focused on Web PKI standards and requirements.
https://zmap.io
Apache License 2.0
351 stars 108 forks source link

w_qcstatem_qctype_web generates false positives for qualified certificates #561

Open AEtherC0r3 opened 3 years ago

AEtherC0r3 commented 3 years ago

If a qualified certificate is not a QWAC (Qualified Web Authentication Certificate) w_qcstatem_qctype_web will be triggered. This lint should not be applicable to certificates that can't be used for TLS server authentication.

sleevi commented 3 years ago

Could you provide an example certificate you believe this is a false-positive for? This would help diagnose.

I "suspect" this is because the early lints from @mtgag unconditionally assume TLS certs (i.e. do not restrict via their CheckApplies function), as I suspect some assumption that this would only be run on TLS hierarchies. I suspect we can resolve this through liberally updating CheckApplies, although there are certainly more fundamental issues with the ETSI specifications in situations trying to figure out if something was "misissued" or not.

AEtherC0r3 commented 3 years ago

The attached certificate is an example of a qualified certificate for qualified eSignatures John Doe.pem

cpu commented 3 years ago

Is this something that should be considered a blocker for https://github.com/zmap/zlint/issues/559 ? My instinct is to revert anything ETSI related that seems buggy but I'll defer to others for this case.

sleevi commented 3 years ago

@cpu I don't think so. This particular lint comes from v1 (that is, before lints were shuffled and split). Specifically, https://github.com/zmap/zlint/pull/250 from 2019. So this is long-standing, (un?)fortunately, and mostly a result of several of the existing ETSI lints assuming they'll only be run in the context of Web PKI hierarchies.

cpu commented 3 years ago

SGTM. I also feel better these days knowing that users can exclude certain lint categories.

mtgag commented 3 years ago

It is true that the assumption made was that only TLS certificates are involved. If the scope of zlint is beyond this use case then this lint is not correct. Two suggestions are to either remove the lint or change the warning to a notice. What is your opinion on this? We could then implement this.