From d5cbe3484248ee5f44543b1b50604bcd5739cc85 Mon Sep 17 00:00:00 2001 From: Darren Krahn Date: Fri, 10 Jul 2020 17:03:57 -0700 Subject: [PATCH] Mark basic constraints critical as appropriate. Per RFC 5280 4.2.1.9 if the 'cA' field is set to true, the extension must be marked critical. --- library/x509write_crt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/library/x509write_crt.c b/library/x509write_crt.c index 32c655096..498b8b0a0 100644 --- a/library/x509write_crt.c +++ b/library/x509write_crt.c @@ -163,7 +163,7 @@ int mbedtls_x509write_crt_set_basic_constraints( mbedtls_x509write_cert *ctx, return( mbedtls_x509write_crt_set_extension( ctx, MBEDTLS_OID_BASIC_CONSTRAINTS, MBEDTLS_OID_SIZE( MBEDTLS_OID_BASIC_CONSTRAINTS ), - 0, buf + sizeof(buf) - len, len ) ); + is_ca, buf + sizeof(buf) - len, len ) ); } #if defined(MBEDTLS_SHA1_C) -- 2.29.0.rc1.297.gfa9743e501-goog