fix: check if responder certificate is issued by cacertificate; fail otherwise

fsrv-xyz · fsrv-xyz · commit e85b77dc1480 · 2025-05-19T19:01:23.000+02:00
Signed-off-by: Florian Bauer &lt;florian@fsrv.xyz&gt;
diff --git a/main.go b/main.go
@@ -119,6 +119,10 @@ func main() {
 		log.Fatalf("failed to parse ca certificate: %v", loadCaCertificateError)
 	}
 
+	if !bytes.Equal(caCertificate.RawSubject, responderKeyPair.Leaf.RawIssuer) {
+		log.Fatalf("responder certificate issuer does not match ca certificate subject; %+q != %+q", caCertificate.Subject.String(), responderKeyPair.Leaf.Issuer.String())
+	}
+
 	source := ocsp_source.NewCrlSource(caCertificate, responderKeyPair)
 
 	crl := &x509.RevocationList{}

Original file line number	Diff line number	Diff line change
`@@ -119,6 +119,10 @@ func main() {`
`119`	`119`	`log.Fatalf("failed to parse ca certificate: %v", loadCaCertificateError)`
`120`	`120`	`}`
`121`	`121`
	`122`	`+ if !bytes.Equal(caCertificate.RawSubject, responderKeyPair.Leaf.RawIssuer) {`
	`123`	`+ log.Fatalf("responder certificate issuer does not match ca certificate subject; %+q != %+q", caCertificate.Subject.String(), responderKeyPair.Leaf.Issuer.String())`
	`124`	`+ }`
	`125`	`+`
`122`	`126`	`source := ocsp_source.NewCrlSource(caCertificate, responderKeyPair)`
`123`	`127`
`124`	`128`	`crl := &x509.RevocationList{}`