unsigned

Documentation

Overview

Package unsigned implements RFC 9925 Unsigned X.509 Certificates.

https://datatracker.ietf.org/doc/html/rfc9925

Index

• func Design(cert []byte, replaceSigAlg bool) ([]byte, error)

Functions

func Design

func Design(cert []byte, replaceSigAlg bool) ([]byte, error)

Design parses the input as an X.509 certificate and returns an unsigned certificate with the same contents.

RFC 9925 says "Senders SHOULD omit the authority key identifier and issuer alternative name extensions", but since we use this for returning lint certificate bytes we leave all fields unchanged, including those fields.

If replaceSigAlg is true, Design emits a proper RFC 9925 certificate with the signature algorithm id-alg-unsigned in both slots. If false, it retains the original signature algorithm and simply truncates the signature. This is convenient for efficiently storing lint certificates where we don't care about the signature bytes.