search

zmap / zlint

X.509 Certificate Linter focused on Web PKI standards and requirements.
https://zmap.io
Apache License 2.0
358 stars 107 forks source link

Unable to detect error when extended attribute value is null！ #862

Open SHECA-Alvin opened 3 months ago

SHECA-Alvin commented 3 months ago

Description

We have a case in bugzilla where several error certificates contain empty cpsurls. We used zlint to check and no errors were reported. Please confirm whether zlint supports this error check. The zlint version used is v3.6.2 bugzilla address: https://bugzilla.mozilla.org/show_bug.cgi?id=1902947

appendix

The relevant error sample book is as follows: -----BEGIN CERTIFICATE----- MIIHfDCCBmSgAwIBAgIQdijhjRc6iD2nu+XtGDLX5DANBgkqhkiG9w0BAQsFADBA MQswCQYDVQQGEwJDTjERMA8GA1UECgwIVW5pVHJ1c3QxHjAcBgNVBAMMFVNIRUNB IEVWIFNlcnZlciBDQSBHMzAeFw0yNDAzMTgwNTM0MThaFw0yNTAzMTgxNTU5NTla MIIBcDEdMBsGA1UEDxMUUHJpdmF0ZSBPcmdhbml6YXRpb24xEzARBgsrBgEEAYI3 PAIBAxMCQ04xGjAYBgsrBgEEAYI3PAIBAgwJ5LiK5rW35biCMRowGAYLKwYBBAGC NzwCAQEMCeS4iua1t+W4gjEbMBkGA1UEBRMSOTEzMTAwMDA2MzEyOTEyODlYMQsw CQYDVQQGEwJDTjESMBAGA1UECAwJ5LiK5rW35biCMRIwEAYDVQQHDAnkuIrmtbfl uIIxDzANBgNVBBETBjIwMDA4MDFDMEEGA1UECQw65LiK5rW35biC6Jm55Y+j5Yy6 5Zub5bed5YyX6LevMTcxN+WPtzE4MDjjgIExODA544CBMTgxMOWupDE2MDQGA1UE Cgwt5LiK5rW35biC5pWw5a2X6K+B5Lmm6K6k6K+B5Lit5b+D5pyJ6ZmQ5YWs5Y+4 MSIwIAYDVQQDExlyc2FldmczLnJldm9rZWQuc2hlY2EuY29tMIIBIjANBgkqhkiG 9w0BAQEFAAOCAQ8AMIIBCgKCAQEAo5512vvetdN4Yp0F5fuYit5yzmwwR9yHQNpt Uu849hRMPfDcFtLTfXPwFHVTvFxPRiGmGIDoFrLnJ1A35Grt98B+avSk3tJFb6jz tP/d2VboRpUgkicaU5Xqpg36rL0M59NGhqKkNu2wsc9+1B7dSqd3EQR2ufD0usPA t7OJ1DXiJR+k8VpHBwVgm0y7shQ3JNOqjdT0jyz4bAcClJFQLWptvVPJbC1I7AZY 7//OBTuGAMD18Vi3fcH/stGitL/i0nMB4WQhpdi4XFIbWafviL1PPQsKi3RYpU72 n6a7YXCumK6x9odqt9pmGGwhUc96KfeZiTLWveI7OCEkJZonbwIDAQABo4IDPjCC AzowHwYDVR0jBBgwFoAUVOly+3hmn+XL8zuPmEZVU3OcC4QwHQYDVR0OBBYEFBzW siu+4iX0YZa4hQQzXBDENlaxMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggr BgEFBQcDAQYIKwYBBQUHAwIwXwYDVR0gBFgwVjA7BgkqgRyG7zoBAQMwLjAsBggr BgEFBQcCARYgaHR0cHM6Ly93d3cuc2hlY2EuY29tL3JlcG9zaXRvcnkwFwYFZ4EM AQEwDjAMBggrBgEFBQcCARYAMCQGA1UdEQQdMBuCGXJzYWV2ZzMucmV2b2tlZC5z aGVjYS5jb20wDAYDVR0TAQH/BAIwADA4BgNVHR8EMTAvMC2gK6AphidodHRwOi8v Y3JsLmdsb2JhbC5zaGVjYS5jb20vZXZzY2FnMy5jcmwwdwYIKwYBBQUHAQEEazBp MDAGCCsGAQUFBzABhiRodHRwOi8vb2NzcC5nbG9iYWwuc2hlY2EuY29tL2V2c2Nh ZzMwNQYIKwYBBQUHMAKGKWh0dHA6Ly9jZXJ0cy5nbG9iYWwuc2hlY2EuY29tL2V2 c2NhZzMuY2VyMIIBfwYKKwYBBAHWeQIEAgSCAW8EggFrAWkAdgDM+w9qhXEJZf6V m1PO6bJ8IumFXA2XjbapflTA/kwNsAAAAY5QDbXBAAAEAwBHMEUCIQDvhPCwmHSC R9NTYozUltUrpCrVDhIxGPm1zIHEiI5jbwIgUaSGy3b6TJQjBJ4i4bDeJlktk5am UXjsFM0s4QqtITEAdgBOdaMnXJoQwzhbbNTfP1LrHfDgjhuNacCx+mSxYpo53wAA AY5QDbXbAAAEAwBHMEUCIQC6ZOWdT938QKn5Yno620rj1asoyEaJuFw4PATORIjA MQIgWmyLdTuuk8mIL0mSvkcfGIV0RROZBJ1KUIYTa8a6KHcAdwDPEVbu1S58r/OH W9lpLpvpGnFnSrAX7KwB0lt3zsw7CAAAAY5QDbljAAAEAwBIMEYCIQDFPZECINh3 XHc/p0YSA2uXpVimDazVnDafXkB2nI8JYAIhAI0Wl+DkwJveSNrhX9GUHa54AxUd fi12ms/GutfBow5DMA0GCSqGSIb3DQEBCwUAA4IBAQAxHBMMywdG+y9gECt7Fr4n CPZsHFMfKgt1zzrCZHdUU1VKGMxLPfuJN9eRqOmnD5HCqFRCZHRl2nBIeB7tEdN+ 3P4cHtIJK14hHlamYOig/iqLMY2ItkiT5XSgVLpyhGaZNmvgXYoD61X0IP1ueMnR w2ivLGwrHtwbRGb0BD6zQN4uBfMPwn3J4TGaCWtG8kulDXJUyKfO1HRJD72tIzPn zE9CRRRpZca27y2V8rSa7K+F5eF4N5ugUybkwrgq7WI/jvTyFE2XNtU57dI16hQ7 qtDi/RcbzJWXzstfDmk5y+KUvfe9bMsKtcBtRU+R5nak3d5EmMEdTl+5tzfyP0Ul -----END CERTIFICATE-----

zakird commented 3 months ago

Hi @SHECA-Alvin! This issue feels like a great opportunity where you could help contribute to ZLint. ZLint is a community project and as it stands, your request comes across as directly offloading the work needed onto other CAs and contributors rather than making a good faith effort to understand what happened. I would encourage you to investigate whether an existing lint should have caught this. If not, can you suggest a lint that would help catch this in the future?

SHECA-Alvin commented 3 months ago

Hi @SHECA-Alvin! This issue feels like a great opportunity where you could help contribute to ZLint. ZLint is a community project and as it stands, your request comes across as directly offloading the work needed onto other CAs and contributors rather than making a good faith effort to understand what happened. I would encourage you to investigate whether an existing lint should have caught this. If not, can you suggest a lint that would help catch this in the future?

Thank you for your reply. I will listen to your advice. Please allow me to do some research on zlint's code first. I am not very good at projects developed in golang language.