boulder icon indicating copy to clipboard operation
boulder copied to clipboard

Consider integrating additional linting frameworks

Open aarongable opened this issue 4 years ago • 0 comments

An incident from earlier this year drives home the fact that no certificate linting library is perfect, and that simply counting on one library to enforce all requirements still provides plenty of avenues for accidental failure.

We should consider integrating additional linting libraries, such as https://github.com/amazon-archives/certlint and/or https://github.com/kroeckx/x509lint, into our issuance pipeline. As these two are C programs, they probably shouldn't be in Boulder's go-based pre- and post-issuance linting, but might be able to be integrated into our post-post-issuance cert-checker.

aarongable avatar Oct 20 '21 00:10 aarongable