From d056229b289cfa0986ce5402dd467f2d0b711db0 Mon Sep 17 00:00:00 2001 From: J3vb Date: Thu, 2 Apr 2026 13:03:02 +0200 Subject: [PATCH] fix: self-signed cert no longer generated as CA (BUG-138) Changed IsCA to false, removed KeyUsageCertSign, and reduced validity from 10 years to 2 years. A compromised key can no longer sign additional certificates trusted by TOFU-pinning clients. --- Server/auth/tls.go | 6 +++--- Server/auth/tls_test.go | 19 +++++++++++++------ 2 files changed, 16 insertions(+), 9 deletions(-) diff --git a/Server/auth/tls.go b/Server/auth/tls.go index 685ee5a3..4d8cf1e8 100644 --- a/Server/auth/tls.go +++ b/Server/auth/tls.go @@ -56,11 +56,11 @@ func GenerateSelfSigned(certFile, keyFile string) error { CommonName: "OwnCord Self-Signed", }, NotBefore: now, - NotAfter: now.Add(10 * 365 * 24 * time.Hour), - KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign, + NotAfter: now.Add(2 * 365 * 24 * time.Hour), + KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature, ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}, BasicConstraintsValid: true, - IsCA: true, + IsCA: false, } certDER, err := x509.CreateCertificate(rand.Reader, template, template, &privKey.PublicKey, privKey) diff --git a/Server/auth/tls_test.go b/Server/auth/tls_test.go index 53ca5bbd..fdc3d42b 100644 --- a/Server/auth/tls_test.go +++ b/Server/auth/tls_test.go @@ -53,15 +53,22 @@ func TestGenerateSelfSignedProducesValidCert(t *testing.T) { t.Fatalf("x509.ParseCertificate error: %v", err) } - // Verify validity period is at least 9 years in the future (10y cert). - minExpiry := time.Now().Add(9 * 365 * 24 * time.Hour) + // Verify validity period is ~2 years (not the old 10y). + minExpiry := time.Now().Add(1 * 365 * 24 * time.Hour) + maxExpiry := time.Now().Add(3 * 365 * 24 * time.Hour) if leaf.NotAfter.Before(minExpiry) { - t.Errorf("cert expires %v, expected at least 9 years from now (%v)", leaf.NotAfter, minExpiry) + t.Errorf("cert expires %v, expected at least 1 year from now (%v)", leaf.NotAfter, minExpiry) + } + if leaf.NotAfter.After(maxExpiry) { + t.Errorf("cert expires %v, expected at most 3 years from now (%v)", leaf.NotAfter, maxExpiry) } - // Verify it is a CA/self-signed cert. - if !leaf.IsCA { - t.Error("expected IsCA = true for self-signed cert") + // BUG-138: Leaf cert must NOT be a CA — prevents signing other certs on key compromise. + if leaf.IsCA { + t.Error("expected IsCA = false for self-signed leaf cert") + } + if leaf.KeyUsage&x509.KeyUsageCertSign != 0 { + t.Error("leaf cert should not have KeyUsageCertSign") } }