Zakir Durumeric comments

Results 116 comments of


                                            Zakir Durumeric

trafficstars

Well formed subject:jurisdiction and cabfOrganizationIdentifier

It looks like there are a bunch of ETSI commits that leaked into this PR. If we can get those cleaned up, we can work on reviewing/merging.

ZLINT for code sign certificates

I suspect that most of the lints you want are going to be RFC-based. I would start by running certificate against RFC-based lints and see where that gets you. You...

FR: Validate postal code

Is this formalized in any standard or baseline requirements? We might be able to add a community-based INFO or WARN lint, but I suspect not a hard error without something...

BR Coverage spreadsheet out-of-date

This is the most up-to-date set we have, if there are errors, it'd be great to get those resolved in the sheet.

Certs with CN containing capital letters flagged by `e_subject_common_name_not_from_san` false positive

I agree that it shouldn't be an error. There isn't security vulnerability here. That said, it is somewhat interesting to note that they have different capitalization. Might be worth having...

Certs with CN containing capital letters flagged by `e_subject_common_name_not_from_san` false positive

Now that we've seen that this would be considerably more complex (and partially undefined) when @szank went to implement this in #188, I think that we should close this issue,...

Certs with CN containing capital letters flagged by `e_subject_common_name_not_from_san` false positive

Can you move this into a new issue? Happy to have conversation there. On Mon, May 21, 2018 at 3:04 AM Maciej Galkowski wrote: > Hi @zakird , @pzb ....

LINT for "The curious case of the Dangerous Delegated Responder Cert"

We'd be happy to accept a lint that checks this.

Request for classification of the key usage "keyEncipherment" in TLS certificates using elliptic curves as "error"

Thanks for the report, @ENEN-DTR. Which lint produced a `WARN` instead of an `ERROR`? Can you point to the BR or RFC that states that this is mandatory?

issuer_dn, subject_dn unnecessary escaping

I looked at the RFC and what ZCrypto is doing is indeed correct. We have to escape the character in the field to build the DN and JSON also dictates...