Skip to content

SC081 shorter validities#952

Merged
christopher-henderson merged 42 commits intozmap:masterfrom
mtgag:sc081_shorter_validities
May 18, 2025
Merged

SC081 shorter validities#952
christopher-henderson merged 42 commits intozmap:masterfrom
mtgag:sc081_shorter_validities

Conversation

@mtgag
Copy link
Copy Markdown
Contributor

@mtgag mtgag commented May 15, 2025

This PR adds new lints for the updated validity periods as outlined in SC81 of the CA/B Forum. See also: https://github.com/cabforum/servercert/pull/553/files.

The implementation is fairly straightforward (adapted from the 397/398-day lints), but I would appreciate it if you could do a plausibility check on the test data and implementation to catch any careless mistakes.

This PR was developed in close collaboration with D-Trust CA, who also sponsored the work.

mtg and others added 30 commits February 4, 2020 17:45
util: gtld_map autopull updates for 2021-10-21T07:25:20 UTC
LintMetadata: lint.LintMetadata{
Name: "e_server_cert_valid_time_longer_than_100_days",
Description: "TLS server certificates issued on or after on or after March 15, 2027 00:00 GMT/UTC must not have a validity period greater than 100 days",
Citation: "https://github.com/cabforum/servercert/pull/553",
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I had this in my TODO list as well, and this is the reason why I had put it off - we don't have an actual citation yet. That is, the ballot has passed, but there isn't a published BR yet.

But I reckon that shouldn't stop us, especially since we have the concrete dates and the concrete dates are far more important than the Section/Paragraph citation.


Subscriber Certificates issued on or after 15 March 2029 SHOULD NOT have a Validity Period greater than 46 days and MUST NOT have a Validity Period greater than 47 days.

| __Certificate issued on or after__ | __Certificate issued before__ | __Maximum Validity Period__ |
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Beautiful ASCII visualization, good work and thank you. I reckon that someone will be confused at some point in the future and this will help the poor soul.

}

func (l *sc081ThirdDate47ServerCertValidityTooLong) Execute(c *x509.Certificate) *lint.LintResult {
maxValidity := 47 * util.DAY_LENGTH
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There's no action or insight targeted at you with the follow comment, I simply feel the need to reflect/rant.


So my OOP addled brain had the thought, this is all mostly the same, minus the actual date, so surely I can think of some way to centralize these lints!.

This thought was informed by a recent incident in my primary duties wherein a junior engineer copied thousands of lines of hard-hitting code to a separate part of the codebase simply because he did not feel like modifying the interface to accommodate a small change. It did not help that he did not bother to test the copied code nor did he inform his team that this code was actually a copy. He, essentially, plagiarized in an industrial setting , but he didn't even bother to plagiarize the tests.

Now the codebase is stuck. He re-arranged the code just enough that it's a non-trivial task to unwind the spaghetti. He also changed an RPC from accepting an int ID to a string ID but does not explain why or what the format of this string is expected to be nor who the consumers of this API is. So it would take at least a week or two for another engineer to reverse engineer all of this and make the codebase sane again.

But now I come back to this and think...this is a fair use of copying logic.

  1. You would need a little class hierarchy (for the lack of a better term in Go)
    1a. There's really no room in this directory for implementing such mini-frameworks
  2. The validity period is not the only difference. We would have to come up with some way to autogenerate the appropriate citation/error string contents.
    2a. This would make the whole thing more difficult to understand for no discernible benefit.
  3. Doing date differences is not exactly some huge algorithm problem that needs to be centralized for sanity's sake.
  4. All of this code is well tested.

And finally, ZLint is unique in that it has to honor the notion that each of these lints may actually move independently of each other in the future. That is, having these lints all resolve down to the same logic can actually cause some real heartache in the future as we would have to decouple them.

So...yeah. Engineering requires nuance and not blind application of "rules of thumb".

Thank you for coming to my TED Talk.


The change in the requirements is described here: https://github.com/cabforum/servercert/pull/553/files

Subscriber Certificates issued on or after 15 March 2026 and before 15 March 2027 SHOULD NOT have a Validity Period greater than 199 days and MUST NOT have a Validity Period greater than 200 days.
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's interesting to see a requirements doc call out that, off-by-one errors happen all the time, so maybe don't cut it so close if you don't want silly outages.

@christopher-henderson christopher-henderson merged commit c730a76 into zmap:master May 18, 2025
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants