8000 Root CA certificate basicConstraint extension pathLenConstraint field SHOULD NOT be present · Issue #4729 · randombit/botan · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Root CA certificate basicConstraint extension pathLenConstraint field SHOULD NOT be present #4729

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
neusdan opened this issue Feb 28, 2025 · 2 comments
Open

Root CA certificate basicConstraint extension pathLenConstraint field SHOULD NOT be present #4729

neusdan opened this issue Feb 28, 2025 · 2 comments

Comments

@neusdan
Copy link
Contributor
neusdan commented Feb 28, 2025 •
edited
Loading

According to the baseline requirements the pathLenConstraint field should not be present for root CA certificates.

Issue found with zlint.

https://github.com/zmap/zlint/blob/master/v3/lints/cabf_br/lint_root_ca_basic_constraints_path_len_constraint_field_present.go

The corresponding baseline requirements: https://cabforum.org/working-groups/server/baseline-requirements/documents/CA-Browser-Forum-TLS-BR-2.1.3.pdf (section 7.1.2.1)
@randombit
Copy link
Owner

So your contention is that create_self_signed_cert should ignore the value of path_limit set in the options struct?

@neusdan
Copy link
Contributor Author
neusdan commented Mar 3, 2025

I understand the baseline requirements in such a way that the pathLenConstraint field should be omitted only for root CA certificates. But to be honest, I don't understand why 😅 and i couldn't find any information on that in my research.

At the moment, Botan is using a path length limit of one as default (for all CA certificates). I wonder if that is a good default because a value of one would allow only one level of CAs under the current CA certificate. Wouldn't it be better if there is by default no restriction at all?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@randombit @neusdan
0