Check and warn if CA certificate isn't marked as critical

Author: marv7000

shared/ssl/ssl.go

@@ -97,6 +97,7 @@ type certificate struct {
 	subjectKeyID string
 	authKeyID    string
 	isCa         bool
+	isCritical   bool
 	isRoot       bool
 }
 
@@ -193,6 +194,8 @@ func extractCertificateData(content []byte) (certificate, error) {
 				cert.authKeyID = strings.ToUpper(strings.TrimSpace(strings.SplitN(line, ":", 2)[1]))
 			} else if nextVal == "basicConstraints" && strings.Contains(line, "CA:TRUE") {
 				cert.isCa = true
+			} else if nextVal == "basicConstraints" && strings.Contains(line, "critical") {
+				cert.isCritical = true
 			} else {
 				// Unhandled extension value
 				continue
@@ -206,6 +209,11 @@ func extractCertificateData(content []byte) (certificate, error) {
 		}
 	}
 
+	// This configuration might not work anymore in the future.
+	if cert.isCa && !cert.isCritical {
+		log.Warn().Msgf(L("Basic constraints for CA should be marked as `%s`, could cause issues otherwise!"), "critical")
+	}
+
 	if cert.subject == cert.issuer {
 		cert.isRoot = true
 		// Some Root CAs might not have their authorityKeyIdentifier set to themself

uyuni-tools.changes.mfriedrich.warn-if-not-critical

@@ -0,0 +1 @@
+- Check and warn if CA certificate isn't marked as critical