Allow serial number 0 for root CA certificates by jackctj117 · Pull Request #9567 · wolfSSL/wolfssl

jackctj117 · 2025-12-19T22:32:58Z

This pull request updates the logic for validating X.509 certificate serial numbers in wolfcrypt/src/asn.c. The main change is to improve compliance with RFC 5280 while allowing for real-world exceptions involving root CAs. The previous strict check for zero serial numbers is now more nuanced, permitting serial number 0 for self-signed CA certificates but still rejecting it for other certificates.

Certificate serial number validation improvements:

Moved and updated the check for serial numbers of 0 to allow self-signed CA (root) certificates to have a serial number of 0, while still treating serial 0 as an error for all other certificates. This better aligns with RFC 5280 and real-world trust store practices. [1] [2]
Removed the previous check that always treated a serial number of 0 as an error, regardless of certificate type.

Testing

Tested with certificates generated using OpenSSL to verify all scenarios:

Root CA with serial 0 loads successfully (previously failed, now passes)
End-entity cert with serial 0 is correctly rejected
Normal end-entity cert signed by root CA with serial 0 verifies successfully
Self-signed non-CA cert with serial 0 is correctly rejected

kareem-wolfssl

Changes look good.

Can you add some test cases with a CA and leaf cert with a serial of 0?

jackctj117 · 2025-12-23T17:44:25Z

@kareem-wolfssl it looks like the failures are looking for an expected failure due to a self-signed CA certificate with serial number 0.

kareem-wolfssl · 2025-12-23T18:00:32Z

@kareem-wolfssl it looks like the failures are looking for an expected failure due to a self-signed CA certificate with serial number 0.

Yes, you will need to update the failing test test_MakeCertWith0Ser since we no longer expect a root CA with serial 0 to fail.

dgarske · 2025-12-26T15:54:31Z

@jackctj117 looks like some valid unit test failures you will need to look into. All related to --enable-asn=original.

FAILURES:
   390: test_SerialNumber0_RootCA

jackctj117 · 2026-01-14T23:19:18Z

Jenkins retest this please. History lost.

jackctj117 · 2026-01-16T18:32:24Z

Jenkins retest this please. History lost.

jackctj117 · 2026-01-17T00:12:48Z

Jenkins retest this please

jackctj117 · 2026-01-20T21:07:22Z

Jenkins retest this please

jackctj117 · 2026-01-21T16:19:17Z

Jenkins retest this

jackctj117 · 2026-01-21T17:01:02Z

Jenkins retest this please

kareem-wolfssl · 2026-01-22T21:44:34Z

tests/api/test_asn.c

+    ExpectIntNE(wolfSSL_CertManagerVerify(cm, eeSerial0File,
+                WOLFSSL_FILETYPE_PEM), WOLFSSL_SUCCESS);


This should test for the expected error code.

kareem-wolfssl · 2026-01-22T21:45:06Z

tests/api/test_asn.c

+    ExpectIntNE(wolfSSL_CertManagerLoadCA(cm, selfSignedNonCASerial0File, NULL),
+                WOLFSSL_SUCCESS);


Same as above, check for the expected error code.

kareem-wolfssl · 2026-01-30T22:50:38Z

Jenkins retest this please.

… test

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

wolfcrypt/src/asn.c:23904

The log message for cert->serialSz == 0 is confusing: it suggests a certificate might legitimately have “no serial number”, but X.509 certificates always have a serial number and RFC 5280 requires it to be present. Consider rewording to clearly state that an empty/zero-length serial is invalid, and (if appropriate in this file) emit the verbose error macro consistently with other parse failures.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

wolfcrypt/src/asn.c

tests/api/test_asn.c

Copilot

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

certs/test-serial0/include.am

wolfcrypt/src/asn.c

certs/test-serial0/generate_certs.sh

tests/api/test_asn.c

Copilot

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-12T17:35:50Z

wolfcrypt/src/asn.c

+#if !defined(WOLFSSL_NO_ASN_STRICT) && !defined(WOLFSSL_PYTHON) && \
+    !defined(WOLFSSL_ASN_ALLOW_0_SERIAL)
+        /* Check for serial number of 0. RFC 5280 section 4.1.2.2 requires
+         * positive serial numbers. However, allow zero for self-signed CA
+         * certificates (root CAs) being loaded as trust anchors since they
+         * are explicitly trusted and some legacy root CAs in real-world
+         * trust stores have serial number 0. */
+        if ((ret == 0) && (cert->serialSz == 1) && (cert->serial[0] == 0)) {
+            if (!(type == CA_TYPE && cert->isCA && cert->selfSigned)
+#ifdef WOLFSSL_CERT_REQ
+                && !cert->isCSR
+#endif
+            ) {
+                WOLFSSL_MSG("Error serial number of 0 for non-root certificate");
+                ret = ASN_PARSE_E;
+            }
+        }
+        if (ret < 0) {
+            return ret;
+        }


Serial-0 enforcement is now only done in ParseCertRelative(). Other parsing entry points that call DecodeToKey()/wc_GetPubX509()/DecodeCertInternal() directly (e.g., certificate loading in src/ssl_load.c) will no longer reject a zero serial even in strict mode. This can reintroduce acceptance of non-root certs with serial 0 in parts of the API; consider adding an equivalent strict check in those code paths (or refactoring the check into a shared helper that supports the root-CA exception).

Copilot · 2026-02-12T17:35:51Z

tests/api/test_asn.c

+#if !defined(NO_CERTS) && !defined(NO_FILESYSTEM) && !defined(NO_RSA)
+    /* Test that root CA certificates with serial number 0 are accepted,
+     * while non-root certificates with serial 0 are rejected (issue #8615) */
+
+#if !defined(WOLFSSL_NO_ASN_STRICT) && !defined(WOLFSSL_PYTHON) && \
+    !defined(WOLFSSL_ASN_ALLOW_0_SERIAL)
+    WOLFSSL_CERT_MANAGER* cm = NULL;
+    const char* rootSerial0File = "./certs/test-serial0/root_serial0.pem";
+    const char* rootNormalFile = "./certs/test-serial0/root.pem";
+    const char* eeSerial0File = "./certs/test-serial0/ee_serial0.pem";
+    const char* eeNormalFile = "./certs/test-serial0/ee_normal.pem";


This test loads/verifies PEM files via wolfSSL_CertManagerLoadCA/Verify, but it’s only guarded by NO_FILESYSTEM/NO_RSA. In builds without PEM-to-DER support (WOLFSSL_PEM_TO_DER), these APIs return NOT_COMPILED_IN and the test will fail. Please guard this test with WOLFSSL_PEM_TO_DER (or switch fixtures to DER and use WOLFSSL_FILETYPE_ASN1).

jackctj117 self-assigned this Dec 19, 2025

kareem-wolfssl reviewed Dec 19, 2025

View reviewed changes

kareem-wolfssl mentioned this pull request Dec 19, 2025

[Bug]: WolfSSL accepts a certificate whose serial number is zero #8615

Open

jackctj117 requested a review from kareem-wolfssl December 23, 2025 17:43

tmael mentioned this pull request Dec 23, 2025

[Bug]: curl: (35) SSL_connect failed with error -140: ASN parsing error, invalid input #7844

Closed

kareem-wolfssl requested changes Jan 22, 2026

View reviewed changes

kareem-wolfssl requested a review from wolfSSL-Bot January 22, 2026 21:47

jackctj117 requested a review from kareem-wolfssl January 30, 2026 22:38

jackctj117 added 8 commits February 3, 2026 14:33

Allow serial number 0 for root CA certificates

2ff3ccd

Added serial 0 tests to unit tests

56b7a05

Fix for old tests

18178a3

Add serial 0 validation to non-template code path

38a1ffc

Add serial 0 validation to original parser, fix CSR handling

7bafa04

Fix test_MakeCertWith0Ser: remove keyCertSign from non-CA certificate…

384471c

… test

Add generated test certificates for serial 0 testing

c529e8d

Added new certs to include.am

af2579c

jackctj117 force-pushed the serial-0 branch from 82c6f7e to af2579c Compare February 3, 2026 21:45

jackctj117 requested a review from Copilot February 5, 2026 19:12

Copilot AI reviewed Feb 5, 2026

View reviewed changes

Copilot started reviewing on behalf of jackctj117 February 5, 2026 20:00 View session

jackctj117 requested a review from Copilot February 5, 2026 20:20

Copilot AI reviewed Feb 5, 2026

View reviewed changes

Copilot started reviewing on behalf of jackctj117 February 5, 2026 20:35 View session

jackctj117 added 2 commits February 5, 2026 16:15

removed trailing whitespaces

8ee52be

Fixes for tests

8c31d3a

jackctj117 requested a review from Copilot February 6, 2026 18:09

Copilot started reviewing on behalf of jackctj117 February 6, 2026 18:11 View session

Copilot AI reviewed Feb 6, 2026

View reviewed changes

wolfcrypt/src/asn.c Outdated Show resolved Hide resolved

tests/api/test_asn.c Outdated Show resolved Hide resolved

jackctj117 requested a review from Copilot February 11, 2026 18:49

Copilot started reviewing on behalf of jackctj117 February 11, 2026 18:50 View session

Copilot AI reviewed Feb 11, 2026

View reviewed changes

certs/test-serial0/include.am Outdated Show resolved Hide resolved

wolfcrypt/src/asn.c Outdated Show resolved Hide resolved

certs/test-serial0/generate_certs.sh Outdated Show resolved Hide resolved

tests/api/test_asn.c Outdated Show resolved Hide resolved

Copilot fixes

23e4453

jackctj117 requested a review from Copilot February 12, 2026 17:25

Copilot started reviewing on behalf of jackctj117 February 12, 2026 17:25 View session

Copilot AI reviewed Feb 12, 2026

View reviewed changes

		ExpectIntNE(wolfSSL_CertManagerVerify(cm, eeSerial0File,
		WOLFSSL_FILETYPE_PEM), WOLFSSL_SUCCESS);

		ExpectIntNE(wolfSSL_CertManagerLoadCA(cm, selfSignedNonCASerial0File, NULL),
		WOLFSSL_SUCCESS);

Conversation

jackctj117 commented Dec 19, 2025

Testing

Uh oh!

kareem-wolfssl left a comment

Choose a reason for hiding this comment

Uh oh!

jackctj117 commented Dec 23, 2025

Uh oh!

kareem-wolfssl commented Dec 23, 2025

Uh oh!

dgarske commented Dec 26, 2025

Uh oh!

jackctj117 commented Jan 14, 2026

Uh oh!

jackctj117 commented Jan 16, 2026

Uh oh!

jackctj117 commented Jan 17, 2026

Uh oh!

jackctj117 commented Jan 20, 2026

Uh oh!

jackctj117 commented Jan 21, 2026

Uh oh!

jackctj117 commented Jan 21, 2026

Uh oh!

kareem-wolfssl Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

kareem-wolfssl Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

kareem-wolfssl commented Jan 30, 2026 • edited by jackctj117 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

kareem-wolfssl commented Jan 30, 2026 •

edited by jackctj117

Loading