2 ms·
(I'm one of the authors). I looked at NIST's PKITS while building the test suite. We ultimately decided to punt on it for the first round of tests, primarily b
by woodruffw 3y ago
(I'm one of the authors).
I looked at NIST's PKITS while building the test suite. We ultimately decided to punt on it for the first round of tests, primarily because it fell slightly out of scope of our MVP on Python Cryptography (being strictly a RFC 3280 suite). We instead chose to integrate the BetterTLS suite[1] (warning: very large page) for the MVP.
With that being said: x509-limbo is open source, and I would be overjoyed if someone added a new `nist::pkits` or similar namespace for these :-). I can't promise that it's an immediate priority for us to add ourselves, however.
> are any of the test cases taken from Chrome's codebase?
Nope. That would also be a valuable thing to have here.
[1]: https://x509-limbo.com/testcases/bettertls/ https://x509-limbo.com/testcases/bettertls/
- ivanr 3y agoFor reference: https://github.com/chromium/chromium/tree/main/net/data/ssl https://github.com/chromium/chromium/tree/main/net/data/ssl It's been a long time since I looked at them, not sure what's in there exactly any more. Ask Ryan perhaps :)
- woodruffw 3y agoThank you! I'll add that to https://github.com/C2SP/x509-limbo/issues/174 https://github.com/C2SP/x509-limbo/issues/174.
- ivanr 3y agoYou may also want to look at https://github.com/digicert/pkilint https://github.com/digicert/pkilint There are other similar tools (cablint, x509lint, zlint), but there's been a lot of good talk about pkilint recently.