search

zmap / zlint

X.509 Certificate Linter focused on Web PKI standards and requirements.
https://zmap.io
Apache License 2.0
361 stars 110 forks source link

Add lint to check that Root CA and TLS SubCA certificates do not contain the OU subject attribute #864

Closed defacto64 closed 4 months ago

defacto64 commented 4 months ago

Starting with v2.0, the CABF BRs prohibit the organizationalUnitName (OU) attribute in the Subject of Root CA and TLS SubCA certificates (they are tolerated, although not recommended, in other types of CA certs such as cross-certificates and non-TLS SubCA certificates). Zlint does not check this requirement as of today, so I propose this lint to fill the gap.

This lint is configurable, thus allowing to safely distinguish a cross-certificate from a normal SubCA certificate. Non-TLS CA certificates and other uncommon types of CA certificates (to which the OU ban does not apply) are ignored via the pre-flight checks. To signal this lint that the certificate under examination is a cross-certificate, pass to zlint a TOML file containing the following directive:

[e_subj_orgunit_in_ca_cert]
CrossCert = true
defacto64 commented 4 months ago

I am fine with the retouches you suggested.