denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

x509: Use issuer certificate's subjectKeyIdentifier if available

Browse Source 
Instead of just generating an authorityKeyIdentifier based on the
issuer's public key, this allows CA certificates to be issued by a
different tool that doesn't use a SHA-1 hash of the subjectPublicKey
for the subjectKeyIdentifier.

Closes strongswan/strongswan#1992
References strongswan/strongswan#1975
This commit is contained in:
Tobias Brunner
2023-11-13 12:32:32 +01:00
parent 1a1dcf93a5
commit a22147a1b2
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/x509/x509_cert.c
+8 -2
View File
@@ -2424,9 +2424,15 @@ static bool generate(private_x509_cert_t *cert, certificate_t *sign_cert,
/* add the keyid authKeyIdentifier for non self-signed certificates */ /* add the keyid authKeyIdentifier for non self-signed certificates */
if (sign_cert) if (sign_cert)
{ {
chunk_t keyid; x509_t *sign_x509 = (x509_t*)sign_cert;
chunk_t keyid = chunk_empty;
if (sign_key->get_fingerprint(sign_key, KEYID_PUBKEY_SHA1, &keyid)) if (sign_cert->get_type(sign_cert) == CERT_X509)
{
keyid = sign_x509->get_authKeyIdentifier(sign_x509);
}
if (keyid.len ||
sign_key->get_fingerprint(sign_key, KEYID_PUBKEY_SHA1, &keyid))
{ {
authKeyIdentifier = asn1_wrap(ASN1_SEQUENCE, "mm", authKeyIdentifier = asn1_wrap(ASN1_SEQUENCE, "mm",
asn1_build_known_oid(OID_AUTHORITY_KEY_ID), asn1_build_known_oid(OID_AUTHORITY_KEY_ID),