search

zmap / zlint

X.509 Certificate Linter focused on Web PKI standards and requirements.
https://zmap.io
Apache License 2.0
353 stars 107 forks source link

w_ct_sct_policy_count_unsatisfied should test only certifcate with EKU serverAuth #706

Open Feelemoon opened 1 year ago

Feelemoon commented 1 year ago

Apple's Certificate Transparency policy states that:

For certificates with a notBefore value equal to or greater than 20210421T00:00:00Z, log operators MAY reject leaf certificates which don’t contain the serverAuth EKU.

And GoogleChome Certificate Transparency Log Policy says:

TLS Server Auth EKU: The Log may reject logging submissions for certificates that do not contain the id-kp-serverAuth Extended Key Usage (EKU).

w_ct_sct_policy_count_unsatisfied should require EKU serverAuth therefore to emit a notice.