Allow serial number 0 for root CA certificates by jackctj117 · Pull Request #9567 · wolfSSL/wolfssl

jackctj117 · 2025-12-19T22:32:58Z

This pull request updates the logic for validating X.509 certificate serial numbers in wolfcrypt/src/asn.c. The main change is to improve compliance with RFC 5280 while allowing for real-world exceptions involving root CAs. The previous strict check for zero serial numbers is now more nuanced, permitting serial number 0 for self-signed CA certificates but still rejecting it for other certificates.

Certificate serial number validation improvements:

Moved and updated the check for serial numbers of 0 to allow self-signed CA (root) certificates to have a serial number of 0, while still treating serial 0 as an error for all other certificates. This better aligns with RFC 5280 and real-world trust store practices. [1] [2]
Removed the previous check that always treated a serial number of 0 as an error, regardless of certificate type.

Testing

Tested with certificates generated using OpenSSL to verify all scenarios:

Root CA with serial 0 loads successfully (previously failed, now passes)
End-entity cert with serial 0 is correctly rejected
Normal end-entity cert signed by root CA with serial 0 verifies successfully
Self-signed non-CA cert with serial 0 is correctly rejected

kareem-wolfssl

Changes look good.

Can you add some test cases with a CA and leaf cert with a serial of 0?

jackctj117 · 2025-12-23T17:44:25Z

@kareem-wolfssl it looks like the failures are looking for an expected failure due to a self-signed CA certificate with serial number 0.

kareem-wolfssl · 2025-12-23T18:00:32Z

@kareem-wolfssl it looks like the failures are looking for an expected failure due to a self-signed CA certificate with serial number 0.

Yes, you will need to update the failing test test_MakeCertWith0Ser since we no longer expect a root CA with serial 0 to fail.

dgarske · 2025-12-26T15:54:31Z

@jackctj117 looks like some valid unit test failures you will need to look into. All related to --enable-asn=original.

FAILURES:
   390: test_SerialNumber0_RootCA

jackctj117 · 2026-01-14T23:19:18Z

Jenkins retest this please. History lost.

jackctj117 · 2026-01-16T18:32:24Z

Jenkins retest this please. History lost.

jackctj117 · 2026-01-17T00:12:48Z

Jenkins retest this please

jackctj117 · 2026-01-20T21:07:22Z

Jenkins retest this please

jackctj117 · 2026-01-21T16:19:17Z

Jenkins retest this

jackctj117 · 2026-01-21T17:01:02Z

Jenkins retest this please

kareem-wolfssl · 2026-01-30T22:50:38Z

Jenkins retest this please

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

wolfcrypt/src/asn.c:23904

The log message for cert->serialSz == 0 is confusing: it suggests a certificate might legitimately have “no serial number”, but X.509 certificates always have a serial number and RFC 5280 requires it to be present. Consider rewording to clearly state that an empty/zero-length serial is invalid, and (if appropriate in this file) emit the verbose error macro consistently with other parse failures.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #9567

Scan targets checked: wolfcrypt-api_misuse, wolfcrypt-bugs, wolfcrypt-compliance, wolfcrypt-concurrency, wolfcrypt-consttime, wolfcrypt-defaults, wolfcrypt-mutation, wolfcrypt-portability, wolfcrypt-proptest, wolfcrypt-src, wolfcrypt-zeroize

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

github-actions · 2026-04-27T20:57:20Z

MemBrowse Memory Report

gcc-arm-cortex-m4

FLASH: .text +192 B (+0.1%, 197,567 B / 262,144 B, total: 75% used)

gcc-arm-cortex-m4-baremetal

FLASH: .text +128 B (+0.2%, 64,633 B / 262,144 B, total: 25% used)

gcc-arm-cortex-m4-min-ecc

FLASH: .text +128 B (+0.2%, 60,219 B / 262,144 B, total: 23% used)

gcc-arm-cortex-m4-tls12

FLASH: .text +256 B (+0.2%, 121,051 B / 262,144 B, total: 46% used)

dgarske · 2026-05-05T19:08:26Z

@jackctj117 please fix merge conflicts. Thanks

…l-open on forged isC

…rror code

… blank line

…action paths

…eachable leak

… exit path

SparkiDev · 2026-05-12T12:18:27Z

Please resolve all comments.

jackctj117 · 2026-05-12T14:26:23Z

@SparkiDev All comments resolved.

jackctj117 self-assigned this Dec 19, 2025

kareem-wolfssl reviewed Dec 19, 2025

View reviewed changes

kareem-wolfssl mentioned this pull request Dec 19, 2025

[Bug]: WolfSSL accepts a certificate whose serial number is zero #8615

Closed

jackctj117 requested a review from kareem-wolfssl December 23, 2025 17:43

tmael mentioned this pull request Dec 23, 2025

[Bug]: curl: (35) SSL_connect failed with error -140: ASN parsing error, invalid input #7844

Closed

kareem-wolfssl requested changes Jan 22, 2026

View reviewed changes

Comment thread tests/api/test_asn.c Outdated

Comment thread tests/api/test_asn.c Outdated

kareem-wolfssl requested a review from wolfSSL-Bot January 22, 2026 21:47

jackctj117 requested a review from kareem-wolfssl January 30, 2026 22:38

jackctj117 force-pushed the serial-0 branch from 82c6f7e to af2579c Compare February 3, 2026 21:45

jackctj117 requested a review from Copilot February 5, 2026 19:12

Copilot AI reviewed Feb 5, 2026

Copilot started reviewing on behalf of jackctj117 February 5, 2026 20:00 View session

jackctj117 requested a review from Copilot February 5, 2026 20:20

Copilot AI reviewed Feb 5, 2026

View reviewed changes

Copilot started reviewing on behalf of jackctj117 February 5, 2026 20:35 View session

jackctj117 requested a review from Copilot February 6, 2026 18:09

Copilot started reviewing on behalf of jackctj117 February 6, 2026 18:11 View session

Copilot AI reviewed Feb 6, 2026

View reviewed changes

Comment thread wolfcrypt/src/asn.c Outdated

Comment thread tests/api/test_asn.c

jackctj117 requested a review from Copilot February 11, 2026 18:49

Copilot started reviewing on behalf of jackctj117 February 11, 2026 18:50 View session

wolfSSL-Fenrir-bot reviewed Apr 13, 2026

View reviewed changes

Comment thread wolfcrypt/src/asn.c Outdated

Comment thread wolfcrypt/src/asn.c

jackctj117 assigned wolfSSL-Bot and unassigned wolfSSL-Bot Apr 15, 2026

jackctj117 requested review from SparkiDev and removed request for douzzer April 20, 2026 15:09

SparkiDev previously approved these changes Apr 20, 2026

View reviewed changes

SparkiDev assigned kareem-wolfssl Apr 20, 2026

jackctj117 dismissed SparkiDev’s stale review via 44b9d68 April 24, 2026 17:27

jackctj117 force-pushed the serial-0 branch from 44b9d68 to 724b28b Compare April 27, 2026 20:26

jackctj117 force-pushed the serial-0 branch from 724b28b to 49f01c1 Compare April 28, 2026 15:24

jackctj117 unassigned kareem-wolfssl May 5, 2026

dgarske assigned jackctj117 May 5, 2026

jackctj117 added 6 commits May 5, 2026 13:44

Allow serial number 0 for root CA certificates

ee744b1

asn: drop redundant serial-0 check in DecodeCertInternal to avoid fai…

f31ef9e

…l-open on forged isC

Skoll review

2cd42c9

tests/api.c: assert serial-0 policy outcome, not specific rejection e…

bb59678

…rror code

tests/api.c: gate test_ParseSerial0FixtureMatrix on (fixtures are RSA)

7647da4

tests/api.c, certs/test-serial0/include.am: drop em dash and trailing…

5da6625

… blank line

jackctj117 force-pushed the serial-0 branch from 3658357 to 5da6625 Compare May 5, 2026 19:47

jackctj117 added 2 commits May 6, 2026 12:53

asn: restore serial-0 rejection in DecodeCertInternal for pubkey-extr…

2cdbd25

…action paths

test: free ECC curve spec cache at unit.test teardown to plug still-r…

30f110b

…eachable leak

jackctj117 removed their assignment May 7, 2026

test: move ECC curve cache cleanup from wolfcrypt_test() to unit.test…

84b94f5

… exit path

kareem-wolfssl approved these changes May 7, 2026

View reviewed changes

dgarske approved these changes May 8, 2026

View reviewed changes

SparkiDev approved these changes May 12, 2026

View reviewed changes

Uh oh!

Conversation

jackctj117 commented Dec 19, 2025

Testing

Uh oh!

kareem-wolfssl left a comment

Choose a reason for hiding this comment

Uh oh!

jackctj117 commented Dec 23, 2025

Uh oh!

kareem-wolfssl commented Dec 23, 2025

Uh oh!

dgarske commented Dec 26, 2025

Uh oh!

jackctj117 commented Jan 14, 2026

Uh oh!

jackctj117 commented Jan 16, 2026

Uh oh!

jackctj117 commented Jan 17, 2026

Uh oh!

jackctj117 commented Jan 20, 2026

Uh oh!

jackctj117 commented Jan 21, 2026

Uh oh!

jackctj117 commented Jan 21, 2026

Uh oh!

Uh oh!

Uh oh!

kareem-wolfssl commented Jan 30, 2026 • edited by jackctj117 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #9567

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

MemBrowse Memory Report

gcc-arm-cortex-m4

gcc-arm-cortex-m4-baremetal

gcc-arm-cortex-m4-min-ecc

gcc-arm-cortex-m4-tls12

Uh oh!

dgarske commented May 5, 2026

Uh oh!

SparkiDev commented May 12, 2026

Uh oh!

jackctj117 commented May 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

kareem-wolfssl commented Jan 30, 2026 •

edited by jackctj117

Loading

github-actions Bot commented Apr 27, 2026 •

edited

Loading