You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
RFC 5280 requires the presence of the AKI extension in certificates unless the certificate is self-signed.
In the case of self-issued certificates that certify public keys with unsupported algorithms, AuthorityKeyIdentifierPresenceValidator reports an "unhandled_exception" finding as the certified public key cannot be loaded by the Cryptography library. This issue has complicated efforts in linting various PQC certificates (both at IETF hackathons as well as examples included in drafts in LAMPS).
AuthorityKeyIdentifierPresenceValidator should be modified to emit a NOTICE-level finding if it cannot determine whether the certificate is self-signed due to the inclusion of an unsupported public key.
The text was updated successfully, but these errors were encountered:
RFC 5280 requires the presence of the AKI extension in certificates unless the certificate is self-signed.
In the case of self-issued certificates that certify public keys with unsupported algorithms,
AuthorityKeyIdentifierPresenceValidator
reports an "unhandled_exception" finding as the certified public key cannot be loaded by the Cryptography library. This issue has complicated efforts in linting various PQC certificates (both at IETF hackathons as well as examples included in drafts in LAMPS).AuthorityKeyIdentifierPresenceValidator
should be modified to emit a NOTICE-level finding if it cannot determine whether the certificate is self-signed due to the inclusion of an unsupported public key.The text was updated successfully, but these errors were encountered: