AtHeartEngineer/PageSigner
1
0
Fork 0
mirror of https://github.com/tlsnotary/PageSigner.git synced 2026-01-09 14:48:07 -05:00
Code Issues Packages Projects Releases Wiki Activity

check that all certs in chain are CAs except for the last one

Browse Source
This commit is contained in:
themighty1
2019-11-20 20:42:26 +01:00
parent 10adb3650e
commit 42a59e9ef2
1 changed files with 32 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
webextension/content/verifychain/verifychain.js
View File

@@ -20,6 +20,13 @@ var Certificate = asn1.define('Certificate', function() {
);
});
const BasicConstraints = asn1.define('BasicConstraints', function() {
this.seq().obj(
this.key('cA').bool().def(false),
this.key('pathLenConstraint').optional().int()
);
});
var TBSCertificate = asn1.define('TBSCertificate', function() {
this.seq().obj(
this.key('version').def('v1').explicit(0).use(Version),
@@ -271,6 +278,31 @@ var verifyCertChain = function(chain) {
var data = new Buffer(cert);
//var data = ba2ua(der);
var c = Certificate.decode(data, 'der');
//find Basic Constraints. Last cert must not be CA but all the others certs must be CAs
var found_bc = false;
var exts = c.tbsCertificate.extensions;
var isCA;
for(var j=0; j < exts.length; j++){
if (exts[j].extnID.toString() != "2,5,29,19"){
continue;
}
else {
found_bc = true;
var bc_bits = exts[j].extnValue;
var isCA = BasicConstraints.decode(new Buffer(bc_bits), "der").cA;
}
}
if (!found_bc){
return false;
}
if (i == 0 && isCA){
return false;
}
if (i > 0 && !isCA){
return false;
}
var sig = c.signature.data;
var alg = c.signatureAlgorithm.algorithm;
var lastalgbyte = alg[alg.length-1];