Summary
The lint lint_ev_organization_id_missing (which sets error e_ev_organization_id_missing) is being raised on EV CA certificates that do not include the cabfOrganizationIdentifier extension, even though per the CAB Forum Extended Validation Guidelines, that extension is not required for CA certificates unless the subject has an organizationIdentifier.
Details
- In the CAB Forum EV Guidelines v2.0.1, section 7.1.2.2 (“CA/Browser Forum Organization Identifier Extension”), the
cabfOrganizationIdentifier extension is marked as Optional. :contentReference[oaicite:7]{index=7}
- The guideline states: “If the subject:organizationIdentifier is present, this field MUST be present.” :contentReference[oaicite:8]{index=8}
- There is no requirement in the EV Guidelines that all CA certificates must have
cabfOrganizationIdentifier — only when the subject has an organizationIdentifier. Also, the guidelines explicitly note that no extension is mandatory on a CA unless it is stated as “Required” in the relevant subsection. :contentReference[oaicite:9]{index=9}
- I have identified at least two EV CA certificates where
zlint currently reports e_ev_organization_id_missing, despite the absence of organizationIdentifier in the subject:
- In both cases, the behavior seems to be a false positive.
Impact
- This lint produces incorrect error reports for legitimate CA certificates, which can lead to confusion, misdiagnosis, or unnecessary CA configuration changes.
- Users of zlint depending on strict EV compliance checks may be incorrectly blocked or misinformed.
Proposed fix / change
- Update
lint_ev_organization_id_missing to skip CA certificates (i.e., certificates with cA=true in BASIC_CONSTRAINTS) when the subject does not have organizationIdentifier.
References
- CAB Forum EV Guidelines v2.0.1, section 7.1.2.2.
Summary
The lint
lint_ev_organization_id_missing(which sets errore_ev_organization_id_missing) is being raised on EV CA certificates that do not include thecabfOrganizationIdentifierextension, even though per the CAB Forum Extended Validation Guidelines, that extension is not required for CA certificates unless the subject has anorganizationIdentifier.Details
cabfOrganizationIdentifierextension is marked as Optional. :contentReference[oaicite:7]{index=7}cabfOrganizationIdentifier— only when the subject has anorganizationIdentifier. Also, the guidelines explicitly note that no extension is mandatory on a CA unless it is stated as “Required” in the relevant subsection. :contentReference[oaicite:9]{index=9}zlintcurrently reportse_ev_organization_id_missing, despite the absence oforganizationIdentifierin the subject:Impact
Proposed fix / change
lint_ev_organization_id_missingto skip CA certificates (i.e., certificates withcA=truein BASIC_CONSTRAINTS) when the subject does not haveorganizationIdentifier.References