certificate-transparency/ctool
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Parse out the poison extension in pre-certs

Browse Source
This commit is contained in:
Pim van Pelt
2026-04-05 22:00:08 +02:00
parent 80fcac77d8
commit d80eeb9677
1 changed files with 15 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
internal/utils/utils.go
View File

@@ -31,7 +31,10 @@ var (
issuerCacheMu sync.Mutex issuerCacheMu sync.Mutex
) )
var oidSCTList = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 11129, 2, 4, 2} var (
oidSCTList = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 11129, 2, 4, 2}
oidCTPoison = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 11129, 2, 4, 3}
)
// CTLogInfo holds details about a CT log from the log list. // CTLogInfo holds details about a CT log from the log list.
type CTLogInfo struct { type CTLogInfo struct {
@@ -91,6 +94,7 @@ type CertDetails struct {
KeyUsage []string `json:"key_usage,omitempty"` KeyUsage []string `json:"key_usage,omitempty"`
ExtKeyUsage []string `json:"ext_key_usage,omitempty"` ExtKeyUsage []string `json:"ext_key_usage,omitempty"`
IsCA bool `json:"is_ca"` IsCA bool `json:"is_ca"`
PoisonExtension bool `json:"poison_extension,omitempty"`
} }
var keyUsageNames = []struct { var keyUsageNames = []struct {
@@ -470,8 +474,10 @@ func fetchIssuer(logURL, fingerprint string) (*IssuerInfo, error) {
// parseCertDetails extracts certificate fields not covered by TrimmedEntry. // parseCertDetails extracts certificate fields not covered by TrimmedEntry.
func parseCertDetails(certDER []byte) *CertDetails { func parseCertDetails(certDER []byte) *CertDetails {
cert, err := x509.ParseCertificate(certDER) // Proceed as long as a cert was returned, even if there are unhandled
if err != nil { // critical extensions (e.g. the CT poison extension in precertificates).
cert, _ := x509.ParseCertificate(certDER)
if cert == nil {
return nil return nil
} }
@@ -508,6 +514,12 @@ func parseCertDetails(certDER []byte) *CertDetails {
d.ExtKeyUsage = append(d.ExtKeyUsage, name) d.ExtKeyUsage = append(d.ExtKeyUsage, name)
} }
} }
for _, ext := range cert.Extensions {
if ext.Id.Equal(oidCTPoison) {
d.PoisonExtension = true
break
}
}
return d return d
} }