Right now, a root appears as something like this:
Serial: 927650371
Valid: 1999-05-25 16:09 UTC to 2019-05-25 16:39 UTC
Signature: SHA1-RSA (self-signed)
Subject Info:
Country: US
Organization: Entrust.net
Organizational Unit: www.entrust.net/CPS incorp. by ref. (limits liab.)
Organizational Unit: (c) 1999 Entrust.net Limited
CommonName: Entrust.net Secure Server Certification Authority
Issuer Info:
Country: US
Organization: Entrust.net
Organizational Unit: www.entrust.net/CPS incorp. by ref. (limits liab.)
Organizational Unit: (c) 1999 Entrust.net Limited
CommonName: Entrust.net Secure Server Certification Authority
Subject Key ID: F0:17:62:13:55:3D:B3:FF:0A:00:6B:FB:50:84:97:F3:ED:62:D0:1A
Authority Key ID: F0:17:62:13:55:3D:B3:FF:0A:00:6B:FB:50:84:97:F3:ED:62:D0:1A
Basic Constraints: CA:true
Key Usage:
Cert Sign
CRL Sign
Warnings:
Size of RSA key should be at least 2048 bits
Signed with SHA1-RSA, which is an outdated signature algorithm
We print (self-signed) next to the signature if it's self-signed.
However, we still print an issuer, repeating all the information from the subject, which since it's self-signed must be the same.
In non-verbose mode, we don't print anything at all indicating it's self-signed.
I propose we change the Issuer Info: field to say something like:
when the certificate is self-signed, in both verbose and non-verbose modes.
No changes to JSON are needed, as it always has a "is_self_signed": true, field, though we could omit the issuer information in that case, but there's no real need to change that.
Right now, a root appears as something like this:
We print (self-signed) next to the signature if it's self-signed.
However, we still print an issuer, repeating all the information from the subject, which since it's self-signed must be the same.
In non-verbose mode, we don't print anything at all indicating it's self-signed.
I propose we change the Issuer Info: field to say something like:
when the certificate is self-signed, in both verbose and non-verbose modes.
No changes to JSON are needed, as it always has a
"is_self_signed": true,field, though we could omit the issuer information in that case, but there's no real need to change that.