wbond / wbond/certvalidator

certvalidator accept a certificate with version 1 and extension fields

Open
#55 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
115
Forks
34
PR merge metrics
No merged PRs in 30d

Description

I have a certificate chain [rootCA,intermediate certificate,leaf certificate], which leaf certificate has extension fields and its version is 1. Clearly, leaf certificate violate Section 4.1.2.1, RFC5280: “When extensions are used, as expected in this profile, version MUST be 3 (value is 2). ”. Meanwhile, the chain can still pass certificate verification with certvalidator0.12.0.dev1 version.

To Reproduce:

import sys
from certvalidator import CertificateValidator, ValidationContext
def main():
    if len(sys.argv) < 3:
        sys.exit(1)      
    ca_path = sys.argv[1]    
    seed_path = sys.argv[2]  
    with open(ca_path, "rb") as f:
        ca_bytes = f.read()       
    with open(seed_path, "rb") as f:
        seed_bytes = f.read()
    context = ValidationContext(
        trust_roots=[ca_bytes],
        allow_fetching=False,
        crls=[],
        ocsps=[]
    )
    validator = CertificateValidator(seed_bytes, validation_context=context)
    validator.validate_usage(key_usage=set())
    print("ok!")
if __name__ == "__main__":
    main()

python3 verify.py ca.pem seed.pem

Expected behavior:
According to RFC 5280, it should be rejected.

test.zip

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Run the verify.py reproduction with ca.pem and seed.pem from test.zip, focusing on CertificateValidator and ValidationContext. Trace how the leaf certificate's version and extension fields are checked, then verify that the invalid chain is rejected while valid certificate chains continue to pass.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cryptography, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
50/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.