TeamHepta/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-03-20 19:21:09 +01:00
Code Issues Packages Projects Releases Wiki Activity

SECURITY.md: make x509 data section more readable

Browse Source 
Signed-off-by: Janos Follath <janos.follath@arm.com>
This commit is contained in:
Janos Follath
2026-01-20 10:38:16 +00:00
parent 7a9eceb53c
commit a852e72746
1 changed files with 11 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
SECURITY.md
View File

@@ -108,15 +108,18 @@ protection against a class of attacks outside of the above described threat
model. Neither does it mean that the failure of such a countermeasure is
considered a vulnerability.
#### Formatting of X.509 certificates and certificate signing requests
#### Formatting of X509 data
When parsing X.509 certificates, certificate signing requests (CSRs) or
certificate revocation lists (CRLs) Mbed TLS does not check that they are
strictly compliant with X.509 and other relevant standards. In the case of
signed certificates and signed CRLs, the signing party is assumed to have
performed this validation (and the certificate or CRL is trusted to be correctly
formatted as long as the signature is correct). Similarly, CSRs are implicitly
trusted by Mbed TLS to be standards-compliant.
This section discusses limitations in how X.509 objects are processed. This
applies to certificates, certificate signing requests (CSRs) and certificate
revocation lists (CRLs).
Mbed TLS does not check that they are strictly compliant with X.509 and other
relevant standards. In the case of signed certificates and signed CRLs, the
signing party is assumed to have performed this validation (and the certificate
or CRL is trusted to be correctly formatted as long as the signature is
correct). Similarly, CSRs are implicitly trusted by Mbed TLS to be
standards-compliant.
**Warning!** Mbed TLS must not be used to sign untrusted CSRs or CRLs unless
extra validation is performed separately to ensure that they are compliant to