wip: refactoring extension handling #164
Commits on Dec 10, 2023
-
-
ext: introduce module for X.509 extension handling
This commit creates a new crate-internal module, `ext`, for managing X.509 extensions. In this commit we wire up emitting extensions managed by this module, but do not yet convert any existing extensions to the new arrangement. This will begin in subsequent commits. This adds a dedicated `Extensions` struct and `Extension` trait that handle: * tracking extensions maintaining insertion order. * ensuring the invariant that we never add more than one instance of the same extension OID. * writing the DER encoded SEQUENCE of extensions. * writing each DER encoded extension SEQUENCE - including the OID, criticality, and value. The `Extension` trait allows common operations across all extensions like: * getting the ext OID. * getting the criticality (using a new `Criticality` enum). * getting the raw DER value.
-
ext: implement authority key identifier.
This commit lifts the authority key identifier extension into the `ext` module.
-
ext: implement subject alternative name.
This commit lifts the subject alternative name extension into the `ext` module. It additionally ensures we never write an empty SAN extension, if the `CertificateParams` contain an empty vec of SAN names. For the time being SAN extensions are always written as non-criticial, but the required plumbing to handle the RFC5280 guidance on SAN ext criticality is added for follow-up adjustment.
-
This commit lifts the key usage extension into the `ext` module.
-
wip: extended key usage (and some CSR fixes)
TODO: Split out the non-eku related bits. This commit lifts the extended key usage extension into the `ext` module.
-
-
ext: implement name constraints
This commit lifts the name constraints extension into the `ext` module.
-
-
-
ext: implement CRL distribution points
This commit lifts the CRL distribution points extension into the `ext` module.
-
-
-
ext: implement subject key ID, specifying SKI
This commit lifts the subject key identifier extension into the `ext` module. Diverging from the existing code we now adhere to the RFC 5280 advice and always emit the SKI extension when generating a certificate. Previously this was only done if the basic constraints specified `IsCa::Ca` or `IsCa::ExplicitNoCa`, but not when using `IsCa::NoCa`.
-
ext: implement basic constraints
This commit lifts the basic constraints extension into the `ext` module.
-
ext: implement custom extensions
This commit lifts the custom extension handling into the `ext` module.
-
-
-
ext: implement crl number extension
This commit lifts the CRL number extension handling into the `ext` module.
-
ext: implement issuing distribution point extension
This commit lifts the CRL issuing distribution point extension handling into the `ext` module.
-
-
-
-
ext: implement reason code extension
This commit lifts the CRL entry reason code extension handling into the `ext` module.
-
ext: implement invalidity date extension
This commit lifts the CRL entry invalidity date extension into the `ext` module. There are no longer any references to the lib.rs `write_x509_extension` helper, so it is also removed.
-
crl: use Extensions to write DER
Now that all of the CRL entry extensions have been migrated to `Extensions` we can let that type write the `SEQUENCE` and extension values. There are no longer any callers to `Extensions.iter()` so we remove that fn.
-
-
-
