Dual Alg Certificate preTBS improvements#13

Open

Frauschi wants to merge 17 commits into

claude/dual-alg-certs-patch-XlfOg

Commits on Apr 30, 2026

Commits on May 1, 2026

dual-alg-certs: stash peer sapki on WOLFSSL, drop KEEP_PEER_CERT force
claude
committed
dual-alg-certs: pre-decode alt key into peer*Key during cert parsing
claude
committed
dual-alg-certs: address review findings on alt-key dispatch
claude
committed
preTBS: replace re-encode reconstruction with byte-exact extension excision
claude
committed
preTBS: enforce X9.146 'altSigValue must be last extension' requirement
claude
committed
preTBS: add CSR support via dedicated CertificationRequestInfo excision
claude
committed
tests: expand dual-alg-cert coverage with preTBS unit tests and a CSR roundtrip
claude
committed
tests: add CSR negative + DecodePeerAltPubKey TLS-handshake coverage
claude
committed
asn: ConfirmSignature accepts SPKI DER for Ed25519 / Ed448 alt-sig verify
claude
committed
preTBS: Ed25519/Ed448 SPKI handling moved into the public decoders
claude
committed
preTBS: excise the signature AlgorithmIdentifier per X9.146 9.8.4
claude
committed
preTBS: revert Ed25519/Ed448 alt-sig support to keep PR scope tight
claude
committed
preTBS: accept BouncyCastle / EJBCA CSR encoding (top-level X9.146 attrs)
claude
committed
preTBS: address review of BC/EJBCA CSR interop commit
claude
committed