Closed Bug 1338194 Opened 7 years ago Closed 7 years ago

Reject ECDSA server certificates that don't include 'digitalSignature' keyUsage

Categories

(NSS :: Libraries, defect)

Product:
NSS
Component:
Libraries
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

(Not tracked)

Status:
RESOLVED WONTFIX

People

(Reporter: ttaubert, Assigned: ttaubert)

Details

This bug is about BoGo test ECDSAKeyUsage-TLS1*. When a keyUsage extension is defined for an ECDSA server certificate we should check that it contains the 'digitalSignature' bit. If a server tries to use an ECDH certificate for ssl_auth_ecdsa suites we should reject it.
Status: ASSIGNED → RESOLVED
Closed: 7 years ago
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.