github.com/letsencrypt/boulder@v0.20251208.0/linter/lints/cpcps/lint_subscriber_cert_validity_greater_than_100_days.go (about)

     1  package cpcps
     2  
     3  import (
     4  	"time"
     5  
     6  	"github.com/zmap/zcrypto/x509"
     7  	"github.com/zmap/zlint/v3/lint"
     8  	"github.com/zmap/zlint/v3/util"
     9  
    10  	"github.com/letsencrypt/boulder/linter/lints"
    11  )
    12  
    13  type subscriberCertValidityTooLong struct{}
    14  
    15  func init() {
    16  	lint.RegisterCertificateLint(&lint.CertificateLint{
    17  		LintMetadata: lint.LintMetadata{
    18  			Name:          "e_subscriber_cert_validity_period_greater_than_100_days",
    19  			Description:   "Let's Encrypt Subscriber Certificates have Validity Periods of up to 100 days",
    20  			Citation:      "CPS: 7.1",
    21  			Source:        lints.LetsEncryptCPS,
    22  			EffectiveDate: lints.CPSV33Date,
    23  		},
    24  		Lint: NewSubscriberCertValidityTooLong,
    25  	})
    26  }
    27  
    28  func NewSubscriberCertValidityTooLong() lint.CertificateLintInterface {
    29  	return &subscriberCertValidityTooLong{}
    30  }
    31  
    32  func (l *subscriberCertValidityTooLong) CheckApplies(c *x509.Certificate) bool {
    33  	return util.IsServerAuthCert(c) && !c.IsCA
    34  }
    35  
    36  func (l *subscriberCertValidityTooLong) Execute(c *x509.Certificate) *lint.LintResult {
    37  	// CPS 7.1: "DV SSL End Entity Certificate Validity Period: Up to 100 days."
    38  	maxValidity := 100 * lints.BRDay
    39  
    40  	// RFC 5280 4.1.2.5: "The validity period for a certificate is the period
    41  	// of time from notBefore through notAfter, inclusive."
    42  	certValidity := c.NotAfter.Add(time.Second).Sub(c.NotBefore)
    43  
    44  	if certValidity > maxValidity {
    45  		return &lint.LintResult{Status: lint.Error}
    46  	}
    47  
    48  	return &lint.LintResult{Status: lint.Pass}
    49  }