1From d5cbe3484248ee5f44543b1b50604bcd5739cc85 Mon Sep 17 00:00:00 2001 2From: Darren Krahn <dkrahn@google.com> 3Date: Fri, 10 Jul 2020 17:03:57 -0700 4Subject: [PATCH] Mark basic constraints critical as appropriate. 5 6Per RFC 5280 4.2.1.9 if the 'cA' field is set to true, the extension 7must be marked critical. 8--- 9 library/x509write_crt.c | 2 +- 10 1 file changed, 1 insertion(+), 1 deletion(-) 11 12diff --git a/library/x509write_crt.c b/library/x509write_crt.c 13index 32c655096..498b8b0a0 100644 14--- a/library/x509write_crt.c 15+++ b/library/x509write_crt.c 16@@ -163,7 +163,7 @@ int mbedtls_x509write_crt_set_basic_constraints( mbedtls_x509write_cert *ctx, 17 return( 18 mbedtls_x509write_crt_set_extension( ctx, MBEDTLS_OID_BASIC_CONSTRAINTS, 19 MBEDTLS_OID_SIZE( MBEDTLS_OID_BASIC_CONSTRAINTS ), 20- 0, buf + sizeof(buf) - len, len ) ); 21+ is_ca, buf + sizeof(buf) - len, len ) ); 22 } 23 24 #if defined(MBEDTLS_SHA1_C) 25-- 262.29.0.rc1.297.gfa9743e501-goog 27 28