X509 certificates - maintaining certification path

General Tech QA/Testing 2 years ago

0 1 0 0 0 tuteeHUB earn credit +10 pts

5 Star Rating 1 Rating

Posted on 16 Aug 2022, this text provides information on QA/Testing related to General Tech. Please note that while accuracy is prioritized, the data presented might not be entirely correct or up-to-date. This information is offered for general knowledge and informational purposes only, and should not be considered as a substitute for professional advice.

Take Quiz To Earn Credits!

Turn Your Knowledge into Earnings.

tuteehub_quiz

Answers (1)

Post Answer
profilepic.png
manpreet Tuteehub forum best answer Best Answer 2 years ago

 

I'm working on X509 storage system for some python based program. All certificates are kept in PostgresSQL database for easy access. All working ok, when for each subject(user or CA authority) there is only one certificate. Then finding validation path is easy, as issuer field uniquely identify next certificate:

UserCert1(CA_cert_class1) -> CA_cert_class1(CA_cert_root) -> CA_cert_root(CA_cert_root)

The problems starts when some certificates are renewed due to expiration or any other reason. Then two or more certificates have the same subject. In that case there is more than one possible certification paths.

UserCert1(CA_cert_class1) -> CA_cert_class1(CA_cert_root)(old)->....
                          -> CA_cert_class1(CA_cert_root)(new)->....

Trying each combination is not a solution. Also removing expired certificates is not a solution, as I need them to validate old digital signatures.

QUESTION: How to uniquely identify issuer cert within X509 certificate. I guess, this have something to do with X509v3 extensions. I'm not sure how to use them.

No matter what stage you're at in your education or career, TuteeHub will help you reach the next level that you're aiming for. Simply,Choose a subject/topic and get started in self-paced practice sessions to improve your knowledge and scores.