rfc5280: Add more name constraint tests #44
Conversation
limbo/testcases/rfc5280.py
Outdated
| critical=False, | ||
| ) | ||
| ) | ||
| intermediate = builder.intermediate_ca(root) |
There was a problem hiding this comment.
I believe subject also needs to be set here, otherwise this chain will be invalid for unrelated reasons (leaf is signed by intermediate, but leaf.issuer != intermediate.subject) 🙂
There was a problem hiding this comment.
I did this in 0f2deaa, but confusingly it was already passing for OpenSSL 🤔 -- OpenSSL ought to have rejected the previous chain, unless I'm missing something.
There was a problem hiding this comment.
Ah good point. Thanks for fixing that.
There was a problem hiding this comment.
I'm not sure why the original chain would be passing via OpenSSL as I think you're correct. I'm not sure how our pyca code responds to it as it's not convenient to test right now (branches have diverged).
There was a problem hiding this comment.
Yeah, hmm. I'm going to link this out to our testcase tracking issue; there's possibly some invalid OpenSSL behavior here that we'll want to test for.
Signed-off-by: William Woodruff <william@trailofbits.com>
Merge branch 'main' into alex/name-constraint-tests Signed-off-by: William Woodruff <william@trailofbits.com>
Signed-off-by: William Woodruff <william@trailofbits.com>
Signed-off-by: William Woodruff <william@trailofbits.com>
Closes #38
Long term we can do more, but I think this covers most of the main stuff.