RFC-5280 has somewhat complicated rules on whether the Subject may be empty. On gnupg-users a problem was described with a Sectigo issued certificate. This is the first cert I have seen with empty Subject and critical marked altSubjectName. This is valid but not supported by LibKSBA.
We need to properly parse such a cert and make sure that gpgsm can work with it.
| rK libksba | |||
| rKf2e2f320c9de Allow for an empty Subject in certs. | |||
| rG GnuPG | |||
| rGe57a2e65d93f gpgsm: Just print a note for an empty subject during import. | |||
| rGe7a9bd320561 gpgsm: Just print a note for an empty subject during import. | |||
| rG3765b42383bb sm: Emit user IDs in colon mode even if the Subject is empty. | |||
| rG1067e544c29d sm: Emit user IDs in colon mode even if the Subject is empty. | |||
| Status | Assigned | Task | ||
|---|---|---|---|---|
| Resolved | • werner | T7171 Allow for empty Subject in X.509 | ||
| Resolved | • werner | T6941 gpgsm/dirmngr: support for end-entity certificates with an empty "Subject DN" |