Skip to content

v0.1.7 — NIST PKITS-validated policy & name-constraint engine

Choose a tag to compare

View all tags
@milkway milkway released this 15 Jun 00:38
· 33 commits to main since this release
v0.1.7
e26040a

Validates the RFC 5280 §6.1 certificate-policy and name-constraint engine against the NIST Public Key Interoperability Test Suite (PKITS).

PKITS results

  • 42/42 certificate-policy tests (§4.8–4.12)
  • 38/38 name-constraint tests (§4.13)

Run with PKITS_DIR=/path/to/pkits cargo test --test pkits -- --ignored.

Bugs found and fixed by PKITS

  • §6.1.3(b)/(c) — a self-issued intermediate certificate is now exempt from the subject name-constraint check (previously rejected valid paths routed through a self-issued CA).
  • §4.2.1.10 — a legacy emailAddress attribute in the subject DN is now promoted to an rfc822Name, so rfc822 name constraints bind it (previously accepted a path that should have been rejected).

Also

  • New public verify_certificate_chain entry point for direct path validation (decoupled from PDF signing).
  • README caveat "not yet PKITS-validated" removed.

🤖 Generated with Claude Code

Assets 2
Loading