certstrap | bootstrap CAs , certificate requests | TLS library

by square Go Version: v1.3.0 License: Apache-2.0

X-Ray Key Features Code Snippets Community Discussions(1)Vulnerabilities Install Support

kandi X-RAY | certstrap Summary

certstrap is a Go library typically used in Security, TLS applications. certstrap has no bugs, it has no vulnerabilities, it has a Permissive License and it has medium support. You can download it from GitHub.

A simple certificate manager written in Go, to bootstrap your own certificate authority and public key infrastructure. Adapted from etcd-ca. certstrap is a very convenient app if you don't feel like dealing with openssl, its myriad of options or config files.

Support

Quality

Security

License

Reuse

Support

certstrap has a medium active ecosystem.

It has 2031 star(s) with 208 fork(s). There are 54 watchers for this library.

It had no major release in the last 12 months.

There are 15 open issues and 45 have been closed. On average issues are closed in 286 days. There are 9 open pull requests and 0 closed requests.

It has a neutral sentiment in the developer community.

The latest version of certstrap is v1.3.0

Quality

certstrap has 0 bugs and 0 code smells.

Security

certstrap has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

certstrap code analysis shows 0 unresolved vulnerabilities.

There are 0 security hotspots that need review.

License

certstrap is licensed under the Apache-2.0 License. This license is Permissive.

Permissive licenses have the least restrictions, and you can use them in most projects.

Reuse

certstrap releases are available to install and integrate.

Installation instructions are not available. Examples and code snippets are available.

It has 2754 lines of code, 145 functions and 31 files.

It has high code complexity. Code complexity directly impacts maintainability of the code.

Top functions reviewed by kandi - BETA

kandi's functional review helps you automatically verify the functionalities of the libraries and avoid rework.
Currently covering the most popular Java, JavaScript and Python libraries. See a Sample of certstrap

Get all kandi verified functions for this library.

certstrap Key Features

No Key Features are available at this moment for certstrap.

certstrap Examples and Code Snippets

No Code Snippets are available at this moment for certstrap.

Community Discussions

Trending Discussions on certstrap

Self signed certificate path constraint exceeded

QUESTION

Self signed certificate path constraint exceeded

Asked 2022-Jan-13 at 20:30

I have the following self signed certificate chain:

RootCA -> IntermediateCA (signed by root) -> Server Cert (leaf for TLS, signed by intermediate)

RootCA has MaxPathLen = 0

My certificates are generated using certstrap using CreateCertificateAuthority and CreateIntermediateCertificateAuthority so I assumed the default settings were correct. But when trying to get my self signed certificates working with Python or Node client side I hit a path length constraint exceeded error.

NOTE: The setup was working fine when using a Go TLS client by just supplying the intermediate CA certificate. Python and Node seem to require the full cert chain hence why the problem arose.

From rfc5280 I see the statement:

In this case, it gives the maximum number of non-self-issued intermediate certificates that may follow this certificate in a valid certification path.

I'm confused by non-self-issued intermediate certificates. Is this implying that my chain is valid because the RootCA signed the intermediate (hence it is not non-self-issued). Or it is not valid, because the intermediate counts as as a non-self-issued certificate. What exactly is self referring to here? It could be self signing or the rootca being self.

Should my rootCA in this case actually have a MaxPathLen of 1?

...

ANSWER

Answered 2022-Jan-13 at 20:30

If the root has a MaxPathLen=0, then it can only issue end-entity certificates and no intermediate CA certificates can follow. The Root CA is self-signed.

In your case, the Root has issued an intermediate CA and that is not allowed. And will get the error you described.

non-self-issued intermediate certificates

This refers to intermediate CAs that can follow the Root that are issued by that Root.

Or it is not valid, because the intermediate counts as as a non-self-issued certificate.

That is correct the intermediate exceeds the MaxPathlen = 0.

Self

Refers to the Root.

Root CA and maxPathLen

The root CA with a maxPathLen >= 1 will work for the scenario presented. It can have an intermediate CA and that intermediate can sign end-entity certs.

Source https://stackoverflow.com/questions/70702548

Community Discussions, Code Snippets contain sources that include Stack Exchange Network