Authority Key Identifier is wrong in signed certificates
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 37
- Forks
- 15
- PR merge metrics
- No merged PRs in 30d
Description
When adding an issuer to certbuilder, the authority key identifier field is populated with the issuers SHA1 of the public key.
RFC5280 recommends the sha1 method, but if you have a signed issuer certificate you should trust the subject key identifier and use that. Not using that will break the subject/authority key identifier chain.
My patch suggestion below uses the subject key.
@@ -182,7 +182,7 @@
self._key_identifier = self._subject_public_key.sha1
self._authority_key_identifier = x509.AuthorityKeyIdentifier({
- 'key_identifier': value.public_key.sha1
+ 'key_identifier': value.key_identifier_value
})
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in certbuilder's issuer-handling code at the _authority_key_identifier assignment shown in the issue. Verify how a signed issuer certificate exposes its subject key identifier, then confirm that the authority key identifier follows that value rather than recalculating the issuer public-key hash; the issue is done when the subject/authority key identifier chain is preserved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cryptography, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 50/100