search

zmap / zlint

X.509 Certificate Linter focused on Web PKI standards and requirements.
https://zmap.io
Apache License 2.0
361 stars 110 forks source link

Add lint for checking compliance with §7.1.2.10.5 of the BRs (CA Certificate Policies) #884

Closed defacto64 closed 1 month ago

defacto64 commented 1 month ago

After reading incident https://bugzilla.mozilla.org/show_bug.cgi?id=1921597 and doing some quick checks, I realized that Zlint lacks a lint related to §7.1.2.10.5 of the BRs. So please add this lint to fill the gap. This lint verifies that a SubCA certificate contains either the AnyPolicy OID (alone) or at least one of the CAB Forum's Reserved Policy OIDs.

defacto64 commented 1 month ago

I really can't figure out what golangci-lint is complaining about, because the source was actually gofmt-ed with -s Can someone give me a hand please?

defacto64 commented 1 month ago

I am closing this PR and opening a new one for better clarity and to facilitate review.