letsencrypt
/
boulder
mirror of https://github.com/letsencrypt/boulder.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ceremony/issuance: Remove PolicyIdentifiers extension and default to Policies (#7969)

This commit is contained in:
Samantha Frank 2025-03-12 21:30:06 -04:00 committed by GitHub
parent 358bdab8f4
commit 5889d6a2a6
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
6 changed files with 6 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
cmd/ceremony/cert.go
View File

@ -318,12 +318,6 @@ func makeTemplate(randReader io.Reader, profile *certProfile, pubKey []byte, tbc
} }
for _, policyConfig := range profile.Policies { for _, policyConfig := range profile.Policies {
asnOID, err := parseOID(policyConfig.OID)
if err != nil {
return nil, err
}
cert.PolicyIdentifiers = append(cert.PolicyIdentifiers, asnOID)
x509OID, err := x509.ParseOID(policyConfig.OID) x509OID, err := x509.ParseOID(policyConfig.OID)
if err != nil { if err != nil {
return nil, fmt.Errorf("failed to parse %s as OID: %w", policyConfig.OID, err) return nil, fmt.Errorf("failed to parse %s as OID: %w", policyConfig.OID, err)

1
cmd/ceremony/cert_test.go
View File

@ -127,7 +127,6 @@ func TestMakeTemplateRoot(t *testing.T) {
test.AssertEquals(t, len(cert.IssuingCertificateURL), 1) test.AssertEquals(t, len(cert.IssuingCertificateURL), 1)
test.AssertEquals(t, cert.IssuingCertificateURL[0], profile.IssuerURL) test.AssertEquals(t, cert.IssuingCertificateURL[0], profile.IssuerURL)
test.AssertEquals(t, cert.KeyUsage, x509.KeyUsageDigitalSignature|x509.KeyUsageCRLSign) test.AssertEquals(t, cert.KeyUsage, x509.KeyUsageDigitalSignature|x509.KeyUsageCRLSign)
test.AssertEquals(t, len(cert.PolicyIdentifiers), 2)
test.AssertEquals(t, len(cert.Policies), 2) test.AssertEquals(t, len(cert.Policies), 2)
test.AssertEquals(t, len(cert.ExtKeyUsage), 0) test.AssertEquals(t, len(cert.ExtKeyUsage), 0)

13
cmd/cert-checker/main_test.go
View File

@ -591,14 +591,11 @@ func TestIgnoredLint(t *testing.T) {
Subject: pkix.Name{ Subject: pkix.Name{
CommonName: "CPU's Cool CA", CommonName: "CPU's Cool CA",
}, },
SerialNumber: serial, SerialNumber: serial,
NotBefore: time.Now(), NotBefore: time.Now(),
NotAfter: time.Now().Add(testValidityDuration - time.Second), NotAfter: time.Now().Add(testValidityDuration - time.Second),
KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign, KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth}, ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
PolicyIdentifiers: []asn1.ObjectIdentifier{
{1, 2, 3},
},
Policies: []x509.OID{x509OID}, Policies: []x509.OID{x509OID},
BasicConstraintsValid: true, BasicConstraintsValid: true,
IsCA: true, IsCA: true,

4
issuance/cert.go
View File

@ -305,7 +305,6 @@ func (i *Issuer) requestValid(clk clock.Clock, prof *Profile, req *IssuanceReque
} }
// Baseline Requirements, Section 7.1.6.1: domain-validated // Baseline Requirements, Section 7.1.6.1: domain-validated
var domainValidatedASN1OID = asn1.ObjectIdentifier{2, 23, 140, 1, 2, 1}
var domainValidatedOID = func() x509.OID { var domainValidatedOID = func() x509.OID {
x509OID, err := x509.OIDFromInts([]uint64{2, 23, 140, 1, 2, 1}) x509OID, err := x509.OIDFromInts([]uint64{2, 23, 140, 1, 2, 1})
if err != nil { if err != nil {
@ -322,8 +321,7 @@ func (i *Issuer) generateTemplate() *x509.Certificate {
IssuingCertificateURL: []string{i.issuerURL}, IssuingCertificateURL: []string{i.issuerURL},
BasicConstraintsValid: true, BasicConstraintsValid: true,
// Baseline Requirements, Section 7.1.6.1: domain-validated // Baseline Requirements, Section 7.1.6.1: domain-validated
PolicyIdentifiers: []asn1.ObjectIdentifier{domainValidatedASN1OID}, Policies: []x509.OID{domainValidatedOID},
Policies: []x509.OID{domainValidatedOID},
} }
return template return template

2
issuance/cert_test.go
View File

@ -9,7 +9,6 @@ import (
"crypto/rsa" "crypto/rsa"
"crypto/x509" "crypto/x509"
"crypto/x509/pkix" "crypto/x509/pkix"
"encoding/asn1"
"encoding/base64" "encoding/base64"
"fmt" "fmt"
"reflect" "reflect"
@ -336,7 +335,6 @@ func TestGenerateTemplate(t *testing.T) {
IssuingCertificateURL: []string{"http://issuer"}, IssuingCertificateURL: []string{"http://issuer"},
OCSPServer: []string{"http://ocsp"}, OCSPServer: []string{"http://ocsp"},
CRLDistributionPoints: nil, CRLDistributionPoints: nil,
PolicyIdentifiers: []asn1.ObjectIdentifier{domainValidatedASN1OID},
Policies: []x509.OID{domainValidatedOID}, Policies: []x509.OID{domainValidatedOID},
} }

1
linter/linter.go
View File

@ -194,7 +194,6 @@ func makeIssuer(realIssuer *x509.Certificate, lintSigner crypto.Signer) (*x509.C
PermittedEmailAddresses: realIssuer.PermittedEmailAddresses, PermittedEmailAddresses: realIssuer.PermittedEmailAddresses,
PermittedIPRanges: realIssuer.PermittedIPRanges, PermittedIPRanges: realIssuer.PermittedIPRanges,
PermittedURIDomains: realIssuer.PermittedURIDomains, PermittedURIDomains: realIssuer.PermittedURIDomains,
PolicyIdentifiers: realIssuer.PolicyIdentifiers,
Policies: realIssuer.Policies, Policies: realIssuer.Policies,
SerialNumber: realIssuer.SerialNumber, SerialNumber: realIssuer.SerialNumber,
Subject: realIssuer.Subject, Subject: realIssuer.Subject,