Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Explicitly print if cert is self-signed in non-verbose mode #169

Open
mcpherrinm opened this issue Oct 17, 2018 · 0 comments
Open

Explicitly print if cert is self-signed in non-verbose mode #169

mcpherrinm opened this issue Oct 17, 2018 · 0 comments

Comments

@mcpherrinm
Copy link
Contributor

Right now, a root appears as something like this:

Serial: 927650371
Valid: 1999-05-25 16:09 UTC to 2019-05-25 16:39 UTC
Signature: SHA1-RSA (self-signed)
Subject Info:
	Country: US
	Organization: Entrust.net
	Organizational Unit: www.entrust.net/CPS incorp. by ref. (limits liab.)
	Organizational Unit: (c) 1999 Entrust.net Limited
	CommonName: Entrust.net Secure Server Certification Authority
Issuer Info:
	Country: US
	Organization: Entrust.net
	Organizational Unit: www.entrust.net/CPS incorp. by ref. (limits liab.)
	Organizational Unit: (c) 1999 Entrust.net Limited
	CommonName: Entrust.net Secure Server Certification Authority
Subject Key ID: F0:17:62:13:55:3D:B3:FF:0A:00:6B:FB:50:84:97:F3:ED:62:D0:1A
Authority Key ID: F0:17:62:13:55:3D:B3:FF:0A:00:6B:FB:50:84:97:F3:ED:62:D0:1A
Basic Constraints: CA:true
Key Usage:
	Cert Sign
	CRL Sign
Warnings:
	Size of RSA key should be at least 2048 bits
	Signed with SHA1-RSA, which is an outdated signature algorithm

We print (self-signed) next to the signature if it's self-signed.
However, we still print an issuer, repeating all the information from the subject, which since it's self-signed must be the same.

In non-verbose mode, we don't print anything at all indicating it's self-signed.

I propose we change the Issuer Info: field to say something like:

Issuer Info:
	Self-signed

when the certificate is self-signed, in both verbose and non-verbose modes.

No changes to JSON are needed, as it always has a "is_self_signed": true, field, though we could omit the issuer information in that case, but there's no real need to change that.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants