lkml.org 
[lkml]   [2021]   [Sep]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH v6 03/13] KEYS: CA link restriction
From
Date

On 9/14/21 5:14 PM, Eric Snowberg wrote:
> Add a new link restriction. Restrict the addition of keys in a keyring
> based on the key to be added being a CA (self-signed).

A self-signed cert can be a root CA cert or a code-signing cert. The way
to differentiate a CA cert is by checking BasicConstraints CA:TRUE and
keyUsage:keyCertSign. Refer to Section Basic Constraints and Key Usage
in the document - https://datatracker.ietf.org/doc/html/rfc5280.

Thanks & Regards,

     - Nayna

\
 
 \ /
  Last update: 2021-09-16 22:06    [W:0.234 / U:0.376 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site