pki: Don't generate negative random serial numbers in X.509 certificates

According to RFC 5280 4.1.2.2 we MUST force non-negative serial numbers.

diff --git a/src/pki/commands/issue.c b/src/pki/commands/issue.c
index d5c33b89f1f2f3a31b87750adf00e758224f552b..c2a120fca315ce0a665809210c944507eb0d0bba 100644 (file)
--- a/src/pki/commands/issue.c
+++ b/src/pki/commands/issue.c
@@ -363,6 +363,7 @@ static int issue()
                        rng->destroy(rng);
                        goto end;
                }
+               serial.ptr[0] &= 0x7F;
                rng->destroy(rng);
        }
 

diff --git a/src/pki/commands/self.c b/src/pki/commands/self.c
index c28c9c291d54ea916da04c66b164d4b0cabc0a26..7d4bf1cc6119c282eb523b454ad0085a99ce3d04 100644 (file)
--- a/src/pki/commands/self.c
+++ b/src/pki/commands/self.c
@@ -314,6 +314,7 @@ static int self()
                        rng->destroy(rng);
                        goto end;
                }
+               serial.ptr[0] &= 0x7F;
                rng->destroy(rng);
        }
        not_before = time(NULL);