Bug reports from Jim Basney

[davidoc]

Placeholder for davidoc

[davidoc]

From Jim (29/10/2009):

I'm running checkcerts.pl (downloaded today from github.com) against a
hostcert, and I get:

$ ./checkcerts.pl -t gfd125-ee.t -c
~/LIGOCA/garlic.phys.uwm.edu.cert.pem
gfd125-ee.t .. 1/? #
#
#  * * *
# Cert Subject: DC=org, DC=ligo, OU=Services, CN=garlic.phys.uwm.edu

#   Failed test 'For regular network entity certificates, there MUST NOT
be any additional characters in the DN commonName.'
#   at gfd125-ee.t line 51.
#                   'garlic.phys.uwm.edu'
#     doesn't match '(?-xism:host/([a-z0-9]+\.)+[a-z0-9]+)'
Use of uninitialized value $value in regexp compilation at gfd125-ee.t
line 79.

Maybe it's assuming that host certificates contain CN=host/fqdn and not
CN=fqdn?

[davidoc]

Also from Jim:

---

Me again. I think I'm seeing a few more false positives from
checkcerts.pl. It tells me:

#   Failed test 'nsComment is not required in EE certificates.'
#   at gfd125-host-ee.t line 149.

but my certificate doesn't contain nsComment.

It also says:

#   Failed test 'DC SHOULD be printableString (2.3)'
#   at gfd125-host-ee.t line 39.

but my certificate has DC encoded as IA5String, which is the preferred
encoding according to GFD.125 Section 3.2.4.

I agree with the other errors it found in the certificates I'm checking.
Thanks again for this very helpful tool!

[davidoc]

• Fixed the CN=host/fqdn assumption.
• Fixed reversed sense of nsComment test.

[davidoc]

• Fixed DN encoding test bugs.