Remove unnecessary KeyUsage checks against issuer certificates (#1209)

fixes #1206
eclipse-milo · Jan 22, 2024 · 25796f8 · 25796f8
1 parent 71940fe
commit 25796f8
Show file tree

Hide file tree

Showing 3 changed files with 0 additions and 83 deletions.
diff --git a/...ain/java/org/eclipse/milo/opcua/stack/core/util/validation/CertificateValidationUtil.java b/...ain/java/org/eclipse/milo/opcua/stack/core/util/validation/CertificateValidationUtil.java
@@ -348,19 +348,6 @@ private static void checkAnchorValidity(
                     );
                 }
             }
-        } else {
-            try {
-                checkIssuerKeyUsage(anchorCert);
-            } catch (UaException e) {
-                if (validationChecks.contains(ValidationCheck.KEY_USAGE_ISSUER)) {
-                    throw e;
-                } else {
-                    LOGGER.warn(
-                        "check suppressed: certificate failed issuer KeyUsage check: {}",
-                        anchorCert.getSubjectX500Principal().getName()
-                    );
-                }
-            }
         }
     }
 
@@ -613,42 +600,6 @@ public static void checkEndEntityExtendedKeyUsage(
         }
     }
 
-    public static void checkIssuerKeyUsage(X509Certificate certificate) throws UaException {
-        boolean[] keyUsage = certificate.getKeyUsage();
-
-        if (keyUsage == null) {
-            throw new UaException(
-                StatusCodes.Bad_CertificateIssuerUseNotAllowed,
-                "KeyUsage extension not found"
-            );
-        }
-
-        boolean digitalSignature = keyUsage[0];
-        boolean keyCertSign = keyUsage[5];
-        boolean crlSign = keyUsage[6];
-
-        if (!digitalSignature) {
-            throw new UaException(
-                StatusCodes.Bad_CertificateIssuerUseNotAllowed,
-                "required KeyUsage 'digitalSignature' not found"
-            );
-        }
-
-        if (!keyCertSign) {
-            throw new UaException(
-                StatusCodes.Bad_CertificateIssuerUseNotAllowed,
-                "required KeyUsage 'keyCertSign' not found"
-            );
-        }
-
-        if (!crlSign) {
-            throw new UaException(
-                StatusCodes.Bad_CertificateIssuerUseNotAllowed,
-                "required KeyUsage 'cRLSign' not found"
-            );
-        }
-    }
-
     /**
      * Validate that the application URI matches the SubjectAltName URI in the given certificate.
      *

diff --git a/.../java/org/eclipse/milo/opcua/stack/core/util/validation/OpcUaCertificateUsageChecker.java b/.../java/org/eclipse/milo/opcua/stack/core/util/validation/OpcUaCertificateUsageChecker.java
@@ -125,33 +125,6 @@ public void check(Certificate cert, Collection<String> unresolvedCritExts) throw
                     );
                 }
             }
-        } else {
-            try {
-                CertificateValidationUtil.checkIssuerKeyUsage((X509Certificate) cert);
-
-                LOGGER.debug(
-                    "validated KeyUsage for issuer: {}",
-                    ((X509Certificate) cert).getSubjectX500Principal().getName()
-                );
-            } catch (UaException e) {
-                if (validationChecks.contains(ValidationCheck.KEY_USAGE_ISSUER) ||
-                    criticalExtensions.contains(KEY_USAGE_OID)
-                ) {
-
-                    throw new CertPathValidatorException(
-                        e.getMessage(),
-                        e,
-                        certPath,
-                        certPath.getCertificates().indexOf(cert),
-                        PKIXReason.INVALID_KEY_USAGE
-                    );
-                } else {
-                    LOGGER.warn(
-                        "check suppressed: certificate failed issuer usage check: {}",
-                        ((X509Certificate) cert).getSubjectX500Principal().getName()
-                    );
-                }
-            }
         }
 
         if (unresolvedCritExts != null && !unresolvedCritExts.isEmpty()) {

diff --git a/...core/src/main/java/org/eclipse/milo/opcua/stack/core/util/validation/ValidationCheck.java b/...core/src/main/java/org/eclipse/milo/opcua/stack/core/util/validation/ValidationCheck.java
@@ -43,13 +43,6 @@ public enum ValidationCheck {
      */
     EXTENDED_KEY_USAGE_END_ENTITY,
 
-    /**
-     * The KeyUsage extension must be present and checked for CA certificates.
-     * <p>
-     * This check does not apply to self-signed end-entity certificates.
-     */
-    KEY_USAGE_ISSUER,
-
     /**
      * Revocation checking must happen.
      */