Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Gracefully handle unsupported public key algorithms for AKI presence check #131

Open
CBonnell opened this issue Nov 15, 2024 · 0 comments
Open
Labels
bug Something isn't working

Comments

@CBonnell
Copy link
Collaborator

RFC 5280 requires the presence of the AKI extension in certificates unless the certificate is self-signed.

In the case of self-issued certificates that certify public keys with unsupported algorithms, AuthorityKeyIdentifierPresenceValidator reports an "unhandled_exception" finding as the certified public key cannot be loaded by the Cryptography library. This issue has complicated efforts in linting various PQC certificates (both at IETF hackathons as well as examples included in drafts in LAMPS).

AuthorityKeyIdentifierPresenceValidator should be modified to emit a NOTICE-level finding if it cannot determine whether the certificate is self-signed due to the inclusion of an unsupported public key.

@CBonnell CBonnell added the bug Something isn't working label Nov 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant