boulder
boulder copied to clipboard
Consider integrating additional linting frameworks
An incident from earlier this year drives home the fact that no certificate linting library is perfect, and that simply counting on one library to enforce all requirements still provides plenty of avenues for accidental failure.
We should consider integrating additional linting libraries, such as https://github.com/amazon-archives/certlint and/or https://github.com/kroeckx/x509lint, into our issuance pipeline. As these two are C programs, they probably shouldn't be in Boulder's go-based pre- and post-issuance linting, but might be able to be integrated into our post-post-issuance cert-checker.