From 7f71ecb9d0b823fb2674e5fa3891d2f6135be1e8 Mon Sep 17 00:00:00 2001 From: Tymur Hulua Date: Thu, 13 Aug 2026 13:35:53 +0200 Subject: [PATCH] EST Rotate - Inclusive E/KU Check; Signed-off-by: Tymur Hulua This commit updates the Key Usage and Extended Key Usage validation for EST-submitted certificates. Instead of requiring Digital Signature on KU and TLS Web Client Authentication on EKU to be the only present usages, the check now verifies that they are included among the others. This change allows EST servers to extend CSRs with additional usages, such as `keyCertSign`, `cRLSign`, or `codeSigning`, without failing validation. E.G: The following certificate would have been rejected in the past, but is now accepted: ``` X509v3 extensions: X509v3 Key Usage: critical Digital Signature, Certificate Sign, CRL Sign X509v3 Extended Key Usage: TLS Web Client Authentication, Code Signing ``` And the following certificate would have been rejected in the past and remains rejected now: ``` X509v3 extensions: X509v3 Key Usage: critical Certificate Sign, CRL Sign X509v3 Extended Key Usage: Code Signing ``` --- internal/rotate_est.go | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/internal/rotate_est.go b/internal/rotate_est.go index d6ad918..1790384 100644 --- a/internal/rotate_est.go +++ b/internal/rotate_est.go @@ -189,18 +189,20 @@ func verifyNewCert(curCert, newCert *x509.Certificate) error { if !bytes.Equal(curCert.RawSubject, newCert.RawSubject) { return errors.New("New cert's subject does not match current cert's") } - foundDigitalSig := false + + foundDigitalSig := newCert.KeyUsage & x509.KeyUsageDigitalSignature != 0 foundClientAuth := false - for _, ext := range newCert.Extensions { - if !foundDigitalSig && ext.Id.Equal(oidKeyUsage) { - foundDigitalSig = bytes.Equal(ext.Value, asn1DigitalSignature) - } else if !foundClientAuth && ext.Id.Equal(oidExtendedKeyUsage) { - foundClientAuth = bytes.Equal(ext.Value, asn1TlsWebClientAuth) + + for _, eku := range newCert.ExtKeyUsage { + if eku == x509.ExtKeyUsageClientAuth { + foundClientAuth = true + break } } if foundDigitalSig && foundClientAuth { return nil } + return errors.New("Missing required extensions for Digital Signature and/or TLS Web Client Authentication") }