Skip to content

v3.7.2

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 20 Sep 18:41
· 11 commits to master since this release
v3.7.2
This tag was signed with the committer’s verified signature.
christopher-henderson Christopher Henderson
GPG key ID: A824534D222BA4D2
Verified
Learn about vigilant mode.
2201405
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ZLint v3.7.2-rc1

The ZMap team is happy to share ZLint v3.7.2.

Thank you to everyone who contributes to ZLint!

New Lints

  • e_qcstatem_psd2_valid Checks that a QC Statement of the type id-etsi-psd2-qcStatement has the correct ASN.1 encoding
  • e_qcstatem_psd2_ncaid_format Checks that the NCAId field of a PSD2 QcStatement has the correct syntax: a 2-letter ISO 3166-1 country code, a hyphen, and a 2-8 character uppercase identifier, or 'NA' for a certificate declaring a PSP_CB or PSP_PA role
  • e_qcstatem_psd2_ncaname_valid Checks that the NCAName field of a PSD2 QcStatement is non-empty and at most 256 characters, or 'NA' for a certificate declaring a PSP_CB or PSP_PA role
  • e_qcstatem_psd2_roles_present Checks that the RolesOfPSP field of a PSD2 QcStatement contains at least one role
  • w_qcstatem_psd2_ncaid_eulist Warns if the NCAId field of a PSD2 QcStatement has a country prefix matching an EU/EEA national competent authority, but the full value does not match that authority's current EBA-published code
  • e_qcstatem_psd2_roles_valid Checks that, for each role in a PSD2 QcStatement's RolesOfPSP whose OID is one of ETSI's registered role OIDs, the role name exactly matches that OID
  • e_qcstatem_psd2_orgid_format Checks that a PSD2 certificate's subject:organizationIdentifier, when it starts with 'PSD', matches the required PSD<country>-<NCAid>-<PSPid> structure (ETSI TS 119 495 V1.1.2 - V1.4.1)
  • w_qcstatem_psd2_orgid_format Warns if a PSD2 certificate's subject:organizationIdentifier does not match the recommended PSD<country>-<NCAid>-<PSPid> structure, now a SHOULD as of ETSI TS 119 495 V1.5.1 onward
  • e_duplicate_etsi_qcstatement Checks for any duplicated ETSI QcStatements
  • e_cabf_org_identifier_joic_mismatch The cabfOrganizationIdentifier field country mismatches the JOI country in the subject DN
  • e_org_validated_invalid_cn In OV S/MIME certs, the Subject CN must either contain an email address or match organizationName
  • e_utf8_replacement_char_in_subject Detects the UTF8 Replacement Character anywhere in the Subject field
  • w_missing_key_usage Subscriber certificates SHOULD include the KeyUsage extension
  • w_cabf_ecc_ku_keyagreement_present For certificates with ECC public keys the keyAgreement key usage is allowed and not recommended
  • e_cs_subject_country_name Code Signing subject:countryName MUST contain the two-letter ISO 3166-1 country code associated with the location of the verified Subject
  • e_cs_subject_locality_or_province_required Non-EV Code Signing Certificate: at least one of subject:localityName or subject:stateOrProvinceName must be present
  • e_cs_requires_org Code Signing certificates MUST include organizationName in the subject field
  • e_cs_subject_prohibited The subject:domainComponent MUST NOT be present in a Code Signing Certificate
  • e_etsi_natural_person_key_usage_mandatory The key usage extension shall be present for ETSI certificates issued to natural persons
  • e_etsi_natural_person_key_usage_correct_values The key usage extension shall contain a valid key usage setting for ETSI certificates issued to natural persons
  • w_etsi_natural_person_key_usage_preferred_values The key usage extension should use specific key usage settings for ETSI certificates issued to natural persons

Bug Fixes

  • lint_cert_policy_ov_requires_country / lint_cab_ov_requires_org fixed so OV-issuing policy-constrained CAs are no longer inadvertently linted, and citations updated to reflect current section numbers
  • lint_ecc_allowed_key_usages added an isSubscriber check so the lint no longer applies to non-subscriber certificates
  • e_server_cert_valid_time_longer_than_200_days fixed stuttered wording in the description
  • e_invalid_certificate_version fixed a typo in the description (X.590 -> X.509)

Misc

  • Upgraded zcrypto to restore Windows and FreeBSD build support
  • Added Deutsche Telekom Security GmbH to the list of known ZLint integrators
  • Updated copyright disclaimers to 2026
  • Updated gtld_map
  • Broad dependency updates (golang.org/x/net, golang.org/x/crypto)

Changelog

  • 2201405 Upgrade zcrypto to fix Windows and FreeBSD build (#1087)
  • 5e25636 Add lint for checking presence of the KeyUsage extension in TLS Subscriber certificates (#1082)
  • 1629a00 Remove suttering from e_server_cert_valid_time_longer_than_200_days description (#1085)
  • e7c03ae Add e_/w_qcstatem_psd2_orgid_format: organizationIdentifier format check for PSD2 certificates (#1079)
  • 75a35ca Add e_qcstatem_psd2_roles_valid: role name/OID validation for PSD2 QCStatements (#1077)
  • 362fc01 Add w_qcstatem_psd2_ncaid_eulist: warn on stale/incorrect EU NCA codes in PSD2 QCStatements (#1078)
  • e2bfccd Add e_qcstatem_psd2_roles_present: RolesOfPSP cardinality check for PSD2 QCStatements (#1076)
  • c117e05 Add e_qcstatem_psd2_ncaname_valid: NCAName length check for PSD2 QCStatements (#1075)
  • 54be9a0 Add e_qcstatem_psd2_ncaid_format: NCAId syntax check for PSD2 QCStatements (#1074)
  • fdd9dae Add e_qcstatem_psd2_valid: structural encoding check for PSD2 QCStatements (#1073)
  • f66fff8 feat: Confirm JoiC matches organizationIdentifier Country / cabfOrganizationIdentifierCountry (#1080)
  • 7d02b26 PR #1069 follow-up (#1071)
  • e918cd9 Add lint to detect UTF8 Replacement Character in the Subject DN (for any kind of certificates) (#1070)
  • 1007b1d Add lint to check for a valid commonName in Organization Validated S/MIME certificates (#1069)
  • 2d3f694 util: gtld_map autopull updates for 2026-07-24T00:50:01 UTC (#1068)
  • c1a5be8 Update copyright disclaimers to 2026 (#1067)
  • df74485 Add lint for duplicate ETSI-defined qCStatements (#1060)
  • 4e81d9b cabf_br: fix typo in invalid certificate version lint description (#1059)
  • 043c651 build(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 in /v3 (#1061)
  • c0fa391 build(deps): bump golang.org/x/net in /v3/cmd/gen_test_crl (#1062)
  • 196a3f1 build(deps): bump golang.org/x/net in /v3/cmd/genTestCerts (#1066)
  • b786890 build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 in /v3 (#1063)
  • 0fe9b70 build(deps): bump golang.org/x/crypto in /v3/cmd/gen_test_crl (#1064)
  • 7de7fbe build(deps): bump golang.org/x/crypto in /v3/cmd/genTestCerts (#1065)
  • b82b486 Add subject country lint (#1058)
  • cf7d616 W cabf ecc ku keyagreement present (#1056)
  • 0c36a71 Add required locality or province lint for code signing certificates (#1055)
  • c22bf76 Add lint to check for sdn org presence in code signing certificates (#1053)
  • 06ef3f0 fix lint_cert_policy_ov_requires_country checkApplies, update citations (#1052)
  • b88ecfa Add isSubscriber check to ecc key usage lint (#1051)
  • 70a4fb1 add lint check for prohibited subject in ev and non-ev certificates (#1049)
  • 28f1510 Add telekom security (#1048)
  • 703e418 Etsi natural person key usage (#1047)

Full Changelog: v3.7.1...v3.7.2

Assets 7
Loading