rustls / rustls/rustls-platform-verifier
Investigate allowing OID_ANY_EKU for certificate verification policies
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 158
- Forks
- 60
- Avg merge
- 5d 10h
- Merged PRs (30d)
- 3
Description
Chromium allows this OID in their Android verifier, so we should investigate if its correct for us to add it addition to the existing server auth EKU. They also check for it and test against it in their verifier.
Additionally, we should take this chance to try and document/verify which EKUs are enforced on what platforms and hopefully make them uniform as reasonable.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the cited Chromium files, X509Util.java and extended_key_usage.h, including the verifier tests referenced by the issue. Compare their OID_ANY_EKU and server-auth handling with this project's platform-specific behavior; done means deciding whether to support it and documenting which EKUs each platform enforces, with behavior made uniform where reasonable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 28/100