zmap / zlint

X.509 Certificate Linter focused on Web PKI standards and requirements.
https://zmap.io
Apache License 2.0
354 stars 107 forks source link

Wildcard EV certificates #634

Closed mimi89999 closed 2 years ago

mimi89999 commented 2 years ago

Hello,

https://cabforum.org/wp-content/uploads/CA-Browser-Forum-EV-Guidelines-1.7.8.pdf#16 states that

Wildcard certificates are not allowed for EV Certificates except as permitted under Appendix F.

However ZLint does not detect this as an issue in EV certificates.

Example: https://crt.sh/?id=5234772527&opt=zlint

$ ./zlint_3.2.0_Linux_x86_64/zlint -longSummary 5234772527.crt 
| LEVEL | # OCCURRENCES |                       DETAILS                       |
+-------+---------------+-----------------------------------------------------+
|  info |             1 |                      n_subject_common_name_included |
|  warn |             1 |   w_tls_server_cert_valid_time_longer_than_397_days |
| error |             0 |                                                  -  |
| fatal |             0 |                                                  -  |