zmap / zlint

X.509 Certificate Linter focused on Web PKI standards and requirements.
https://zmap.io
Apache License 2.0
361 stars 110 forks source link

Add lint for checking that the 'critical' field is properly DER-encoded in extensions #839

Closed defacto64 closed 6 months ago

defacto64 commented 6 months ago

It is generally considered a requirement that certificates be DER encoded (meaning not BER), although RFC 5280 is not crystal clear on this. In any case, the non-properly-DER encoding of some certificate fields has historically been considered a compliance error, as it can be seen on https://bugzilla.mozilla.org, therefore it's useful to be able to detect it.

Among other things, DER stipulates that "the encoding of a set value or sequence value shall not include an encoding for any component value which is equal to its default value" (see X.690). Therefore, when a certificate extension is not critical, its 'critical' field should be omitted. This lint checks just that.