search

zmap / zlint

X.509 Certificate Linter focused on Web PKI standards and requirements.
https://zmap.io
Apache License 2.0
358 stars 107 forks source link

ISO 3166-2 countryCodes must be uppercase #855

Open defacto64 opened 3 months ago

defacto64 commented 3 months ago

In light of the discussion we find on two incidents on https://bugzilla.mozilla.org/, I think than by now it is quite clear that the ISO 3166-2 countryCode must be in uppercase, at least from the point of view of some Root Programs.

At the moment Zlint ignores the countryCode case, so I think it would be appropriate to remedy this shortcoming. We can do this in two alternative ways: by modifying the already existing lint (e_subject_country_not_iso) or by introducing a new lint; what do you think is the best choice?

christopher-henderson commented 3 months ago

I think I'm somewhat partial to making a new lint. e_subject_country_not_iso checks for the presence of a country code, whereas what we are looking at here is whether-or-not the country code that is present is formatted correctly.