Remove BASIC_CONSTRAINTS_STRING_FALSE_CASE2
#3422
Conversation
Fix DMTF#3419 and enforce strict DER checks. Signed-off-by: Steven Bellock <sbellock@nvidia.com>
| sizeof(basic_constraints_false_case)))) { | ||
| return true; | ||
| } | ||
|
|
There was a problem hiding this comment.
If I'm reading commit a9e42b0 correctly, then it appears this would trigger a "false"/failure of any existing/previous deployed leaf certificate with the Basic Constraints OID's CA:FALSE (len!=sizeof(basic_constraints_false_case fallout case), which libspdm_verify_leaf_cert_basic_constraints() used to pass.
Could the empty CA:FALSE check be made optional for SPDM Requesters that choose to handle this case?
There was a problem hiding this comment.
Could the empty CA:FALSE check be made optional for SPDM Requesters that choose to handle this case?
#3164 (comment) proposes to let the Integrator selectively disable specific checks, so when/if that gets implemented then they would be able to disable the Basic Constraints check if they so desire.
|
Converting to draft while we wait for the SPDM WG. |
2 participants
Fix #3419 and enforce strict DER checks.