Enforce CSR proof of possession during certificate issuance

2026-10-25 21:21:16 +00:00
parent cc7059c100
commit a8d322776d
2 changed files with 63 additions and 0 deletions
@@ -672,6 +672,10 @@ async def issue_certificate(
    request_obj = await find_request(vault, payload.get("request_id"))
    if payload.get("request_id") and request_obj is None:
        raise ValidationError("signing request not found")
+    if request_obj is not None:
+        csr = req_core.parse_csr(bytes(request_obj.req_der))
+        if not req_core.verify_csr(csr):
+            raise ValidationError("signing request has an invalid signature")

    signer = await find_certificate(vault, payload.get("signer_id"))
    if payload.get("signer_id") and signer is None: