node-opcua / node-opcua-pki / 37063290493

92%

push

github

fix(certificate-manager): a trusted CA above a known issuer makes the chain trusted

verifyCertificate only asked whether the direct issuer was in the
trusted store, so a trusted root with its intermediate in the issuers
store answered BadCertificateUntrusted. OPC 10000-4 6.1.3 refuses a
certificate only when no CA of its chain is trusted. A known issuer now
carries the trust of the CA above it, in relaxed mode only.

Trust that flows through a certificate requires that certificate to be
a CA (basicConstraints cA, keyCertSign) whose pathLenConstraint allows
the chain. Without it, any end-entity certificate of a trusted CA could
sign certificates that were then accepted.

718 of 935 branches covered (76.79%)

14 of 16 new or added lines in 1 file covered. (87.5%)

1936 of 2114 relevant lines covered (91.58%)

515.83 hits per line