Hi there! I was poking at astral-sh/uv#18890, and added some test cases to x509-limbo to test a theory of mine: C2SP/x509-limbo#585
Based on those results, rustls/webpki is doing something slightly out of alignment with other validators: it looks like you all prematurely reject members of a trust program (OS cert bundle, PEM bundle, whatever else) that don't satisfy your extension validator. By contrast, other validators only reject on chain construction if that invalid/unacceptable trust program member is actually used during construction.
You can see a matrix of behaviors for webpki versus other implementations here:
https://x509-limbo.com/testcases/rfc5280/#rfc5280unknown-critical-extension-unrelated-root
TL;DR is that all others accept a trusted set/trust program where rootB has an unrecognized critical extension, so long as rootB is not ever actually used during path construction.
Expected behavior
I think my expected behavior here is for the webpki crate to behave similarly to OpenSSL and other validators, where trust program members are not eagerly checked for extension validity.
In practice I think this is a non-issue for the Web PKI, it appears to mostly snare corporate users who have a single PEM bundle for all of their corporate stuff, including CA certificates that contain critical Certificate Policies and other troublesome extensions. See astral-sh/uv#18890 (comment) for an example of that.
Hi there! I was poking at astral-sh/uv#18890, and added some test cases to x509-limbo to test a theory of mine: C2SP/x509-limbo#585
Based on those results,
rustls/webpkiis doing something slightly out of alignment with other validators: it looks like you all prematurely reject members of a trust program (OS cert bundle, PEM bundle, whatever else) that don't satisfy your extension validator. By contrast, other validators only reject on chain construction if that invalid/unacceptable trust program member is actually used during construction.You can see a matrix of behaviors for
webpkiversus other implementations here:https://x509-limbo.com/testcases/rfc5280/#rfc5280unknown-critical-extension-unrelated-root
TL;DR is that all others accept a trusted set/trust program where
rootBhas an unrecognized critical extension, so long asrootBis not ever actually used during path construction.Expected behavior
I think my expected behavior here is for the
webpkicrate to behave similarly to OpenSSL and other validators, where trust program members are not eagerly checked for extension validity.In practice I think this is a non-issue for the Web PKI, it appears to mostly snare corporate users who have a single PEM bundle for all of their corporate stuff, including CA certificates that contain critical Certificate Policies and other troublesome extensions. See astral-sh/uv#18890 (comment) for an example of that.