letsencrypt / letsencrypt/cp-cps
Make digitalSignature optional for TLS Subordinate CA Certificate Profile
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 38
- Forks
- 26
- PR merge metrics
- No merged PRs in 30d
Description
In the BRs, it is permitted but not required, with a footnote saying "If a CA Certificate does not assert the digitalSignature bit, the CA Private Key MUST NOT be used to sign an OCSP Response." Now that we don't do OCSP, we don't need digitalSignature in future TLS Subordinate CA Certificates, and we can make it optional in the CP-CPS.
https://letsencrypt.org/documents/isrg-cp-cps-v6.1/#tls-subordinate-ca-certificate-profile
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the TLS Subordinate CA Certificate Profile in the CP-CPS and compare its digitalSignature requirement with CA/B Forum Baseline Requirements section 7.2.1.7. Done means the CP-CPS permits digitalSignature to be omitted for future TLS Subordinate CA Certificates and reflects the stated OCSP context.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100