pomerium / pomerium / 5823722856

45%

push

github

authorize: allow client certificate intermediates (#4451)

Update the isValidClientCertificate() method to consider any
client-supplied intermediate certificates. Previously, in order to trust
client certificates issued by an intermediate CA, users would need to
include that intermediate CA's certificate directly in the client_ca
setting. After this change, only the trusted root CA needs to be set: as
long as the client can supply a set of certificates that chain back to
this trusted root, the client's certificate will validate successfully.

Rework the previous CRL checking logic to now consider CRLs for all
issuers in the verified chains.

47 of 47 new or added lines in 1 file covered. (100.0%)

14101 of 22050 relevant lines covered (63.95%)

118.08 hits per line