Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

sunlight: require binary comparison in chain building #69

Closed
wants to merge 1 commit into from
Closed

sunlight: require binary comparison in chain building #69

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion sunlight.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,10 @@ In particular, a Sunlight log MUST implement:
The Signed Certificate Timestamp and its signature MUST be calculated according
to RFC 6962, Section 3.2.

As an additional requirement on top of those of RFC 6962, the Issuer of each
certificate in a submitted chain MUST match its parent's Subject by binary
comparison, without applying the rules of RFC 5280, Section 7.

### SCT Extension

RFC 6962 specifies no extensions, and current logs produce empty extensions
Expand Down Expand Up @@ -302,7 +306,12 @@ the checkpoint.

The bundle consists of a deduplicated sequence of PEM-encoded certificates in
unspecified order. It MUST include every issuer of every submitted chain
accepted by the log, excluding any Precertificate Signing Certificates.
accepted by the log, excluding any Precertificate Signing Certificates,
including any roots, even if not included in the submitted chain by the client.

Monitors can use this bundle to reconstruct chains from submitted certificates
to roots. Note that monitors can rely on the requirement for binary comparison
of Subject and Issuer in submitted chains to simplify chain-building.

## Acknowledgements

Expand Down