x509-validation 1.4.3 → 1.4.4

raw patch · 2 files changed

+7/−2 lines, 2 files

Files

• Data/X509/Validation.hs +6/−1
• x509-validation.cabal +1/−1

@@ -132,6 +132,11 @@             | otherwise =                 (\x -> (x, filter (/= x) chain)) `fmap` find (matchSI issuerDN) chain +        -- we check here that the certificate is allowed to be a certificate+        -- authority, by checking the BasicConstraint extension. We also check,+        -- if present the key usage extension for ability to cert sign. If this+        -- extension is not present, then according to RFC 5280, it's safe to+        -- assume that only cert sign (and crl sign) are allowed by this certificate.         checkCA :: Certificate -> [FailedReason]         checkCA cert             | allowedSign && allowedCA = []@@ -140,7 +145,7 @@           where extensions  = (certExtensions cert)                 allowedSign = case extensionGet extensions of                                 Just (ExtKeyUsage flags) -> KeyUsage_keyCertSign `elem` flags-                                Nothing                  -> False+                                Nothing                  -> True                 allowedCA   = case extensionGet extensions of                                 Just (ExtBasicConstraints True _) -> True                                 _                                 -> False

@@ -1,5 +1,5 @@ Name:                x509-validation-Version:             1.4.3+Version:             1.4.4 Description:         X.509 Certificate and CRL validation License:             BSD3 License-file:        LICENSE