Skip to content

Conversation

@peppelinux
Copy link
Member

This PR aligns the X509 chains with ETSI and it-wallet requirements

@peppelinux peppelinux changed the base branch from main to dev July 3, 2025 10:24
@peppelinux peppelinux requested a review from PascalDR July 3, 2025 10:24
@peppelinux
Copy link
Member Author

the CI fails due to some dependency donwgrading cryptography

it must be at least version 45 to make OID ORGANIZATION IDENTIFIER working.

@peppelinux
Copy link
Member Author

the dep making the dongrading is oic

Collecting cryptography (from oic>=1.2.1->pyop>=v3.4.0->satosa<8.6,>=8.4)
  Downloading cryptography-43.0.3-cp39-abi3-manylinux_2_28_x86_64.whl.metadata (5.4 kB)

"permitted_subtrees": [
x509.DNSName(ca_dns),
x509.DNSName(intermediate_dns),
x509.DNSName(leaf_dns),
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
x509.DNSName(leaf_dns),

the CA cannot know a priori to which leaf the intermediate will issue the certificates

@peppelinux peppelinux merged commit 8780ef7 into dev Sep 11, 2025
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants