232738 - PKITS test 4.7.5 fails, NSS ignores non-critical Key Usage extensions

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P2)

Description

[Nelson Bolyard (seldom reads bugmail)]

RFC 3280 says that implementations MUST honor Key Usage extensions, whether
or not they are critical.  NSS ignores non-critical Key Usage extensions,
and so fails PKITS test 4.7.5.

Patch forthcoming.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

Attachment: patch v1

With this patch, NSS will no longer ignore non-critical key usage extensions.

It is POSSIBLE that some web sites and some email certs will stop working, 
because they have key usage extensions in their CA certs that say that 
their CA certs cannot be used for the purposes for which they use them.
Those formerly worked, because NSS ignored the non-critical key usage 
extension.  Now, when NSS enforces it, users whose certs never should have 
worked will stop working.  

But it's the right thing to do.

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

Adding potential reviewers to CC list

Comment 3

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 140306 [details] [diff] [review]
patch v1

Please review this patch after reading the bug comments.  Thanks.

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

/cvsroot/mozilla/security/nss/lib/certdb/certv3.c,v  <--  certv3.c
new revision: 1.7; previous revision: 1.6