(#983) Fix CRL extensions lint#984
Conversation
|
Thanks a lot |
There was a problem hiding this comment.
Thank you @XolphinMartijn
@kowshikRoy a heads-up that I agree with this change. At the heart of the issue is that the lint explicitly enumerated a list of discouraged extensions and (properly) issued a warning if they were present. However, the BRs states that this should be the behavior for Any other value, not just those specific values that were explicitly outlined.
In the test case changed in this PR, cRLReason changes from being an error to being a warning.
aarongable
left a comment
There was a problem hiding this comment.
This test case should not have been removed; it instead should have been replaced with a CRL that has the proper issuingDistributionPoint (OID 2.5.29.31) extension, instead of the improper crlDistributionPoints (OID 2.5.29.28) extension, which is used in Certificates.
This test fix was missed in #974, which only updated the happy-path test case.
I'll agree with Aaron here. This was a question of interpretation. My interpretation was they were testing the Fail on a not allowed extension, which was incorrect. If the test entity was incorrect, indeed Aaron's interpretation also makes sense, and we should add such a test |
This update includes: