TeamHepta/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-03-20 19:21:09 +01:00
Code Issues Packages Projects Releases Wiki Activity

SECURITY.md: make x509 data section more readable

Browse Source 
Signed-off-by: Janos Follath <janos.follath@arm.com>
This commit is contained in:
Janos Follath
2026-01-20 10:38:16 +00:00
parent 7b2ad1c518
commit 92dbfb34f0
1 changed files with 11 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
SECURITY.md
View File

@@ -145,15 +145,18 @@ Policy](https://github.com/hacl-star/hacl-star/blob/main/SECURITY.md).)
The Everest variant is only used when `MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED` The Everest variant is only used when `MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED`
configuration option is defined. This option is off by default. configuration option is defined. This option is off by default.
#### Formatting of X.509 certificates and certificate signing requests #### Formatting of X509 data
When parsing X.509 certificates, certificate signing requests (CSRs) or This section discusses limitations in how X.509 objects are processed. This
certificate revocation lists (CRLs) Mbed TLS does not check that they are applies to certificates, certificate signing requests (CSRs) and certificate
strictly compliant with X.509 and other relevant standards. In the case of revocation lists (CRLs).
signed certificates and signed CRLs, the signing party is assumed to have
performed this validation (and the certificate or CRL is trusted to be correctly Mbed TLS does not check that they are strictly compliant with X.509 and other
formatted as long as the signature is correct). Similarly, CSRs are implicitly relevant standards. In the case of signed certificates and signed CRLs, the
trusted by Mbed TLS to be standards-compliant. signing party is assumed to have performed this validation (and the certificate
or CRL is trusted to be correctly formatted as long as the signature is
correct). Similarly, CSRs are implicitly trusted by Mbed TLS to be
standards-compliant.
**Warning!** Mbed TLS must not be used to sign untrusted CSRs or CRLs unless **Warning!** Mbed TLS must not be used to sign untrusted CSRs or CRLs unless
extra validation is performed separately to ensure that they are compliant to extra validation is performed separately to ensure that they are compliant to