node-opcua / node-opcua-pki / 36876756002

92%

push

github

fix: treat a certificate with an empty authorityKeyIdentifier as self-signed

A self-signed certificate whose authorityKeyIdentifier extension is
present but empty (SEQUENCE {}) was taken for a CA-issued one, so
addTrustedCertificateFromChain answered BadCertificateChainIncomplete.

isSelfSigned2 compared subjectKeyIdentifier with the authority
keyIdentifier only. When there is no authority keyIdentifier to match
on, it now falls back to subject name equal to issuer name; callers
still verify the signature.

The fixture is a real certificate of that shape from a third-party SDK.

700 of 920 branches covered (76.09%)

6 of 6 new or added lines in 1 file covered. (100.0%)

1900 of 2075 relevant lines covered (91.57%)

488.65 hits per line