diff --git a/src/csr.rs b/src/csr.rs index 4474428b..26add6fe 100644 --- a/src/csr.rs +++ b/src/csr.rs @@ -1,5 +1,5 @@ #[cfg(feature = "x509-parser")] -use crate::{CustomExtension, DistinguishedName, SanType}; +use crate::{BasicConstraints, CustomExtension, DistinguishedName, IsCa, SanType}; #[cfg(feature = "pem")] use pem::Pem; use std::hash::Hash; @@ -100,6 +100,20 @@ impl CertificateSigningRequest { params.key_identifier = ski.0.to_vec(); true }, + x509_parser::extensions::ParsedExtension::BasicConstraints(bc) => { + params.is_ca = match (bc.ca, bc.path_len_constraint) { + (false, _) => IsCa::ExplicitNoCa, + (true, None) => IsCa::Ca(BasicConstraints::Unconstrained), + (true, Some(len_constraint)) => { + IsCa::Ca(BasicConstraints::Constrained( + len_constraint + .try_into() + .map_err(|_| Error::UnsupportedBasicConstraintsPathLen)?, + )) + }, + }; + true + }, _ => false, }; if !supported { @@ -113,7 +127,6 @@ impl CertificateSigningRequest { } // Not yet handled: - // * is_ca // * extended_key_usages // * name_constraints // and any other extensions. diff --git a/src/error.rs b/src/error.rs index 2586a36e..3130940b 100644 --- a/src/error.rs +++ b/src/error.rs @@ -38,6 +38,9 @@ pub enum Error { RingUnspecified, /// Time conversion related errors Time, + /// Unsupported basic constraints extension path length in CSR + #[cfg(feature = "x509-parser")] + UnsupportedBasicConstraintsPathLen, /// Unsupported extension requested in CSR #[cfg(feature = "x509-parser")] UnsupportedExtension, @@ -96,6 +99,11 @@ impl fmt::Display for Error { DuplicateExtension(oid) => { write!(f, "Extension with OID {oid} present multiple times")? }, + #[cfg(feature = "x509-parser")] + UnsupportedBasicConstraintsPathLen => write!( + f, + "Unsupported basic constraints extension path length constraint in CSR" + )?, }; Ok(()) }