zmap / zlint

X.509 Certificate Linter focused on Web PKI standards and requirements.
https://zmap.io
Apache License 2.0
361 stars 110 forks source link

Lint for 7.1.2.7.2 BR #810

Closed mtgag closed 8 months ago

mtgag commented 8 months ago

This pull request adds a lint for the presence of attributes other than CN and C in the subject of DV certificates. This work has been made in close cooperation with the D-Trust CA. We would be grateful if you could incorporate this PR in the main project.

Citation (https://cabforum.org/uploads/CA-Browser-Forum-BR-v2.0.0.pdf): 7.1.2.7.2 Domain Validated

The following table details the acceptable AttributeTypes that may appear within the type field of an AttributeTypeAndValue, as well as the contents permitted within the value field.

Table 35: Domain Validated subject Attributes

countryName MAY The two-letter ISO 3166-1 country code for the country associated with the Subject. Section 3.2.2.3

commonName NOT RECOMMENDED If present, MUST contain a value derived from the subjectAltName extension according to Section 7.1.4.3.

Any other attribute MUST NOT