crypto/tls: allow the usage of other keyUsage when checking for the d…

…c extension #72 (#73)
cloudflare · Jan 14, 2022 · 08d9645 · 08d9645
1 parent baea2bd
commit 08d9645
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/crypto/x509/x509.go b/src/crypto/x509/x509.go
@@ -1090,7 +1090,7 @@ func buildCertExtensions(template *Certificate, subjectIsEmpty bool, authorityKe
 	}
 
 	// This extension is not critical
-	if template.KeyUsage == KeyUsageDigitalSignature && template.AllowDC && !template.IsCA && !oidInExtensions(oidExtensionDelegatedCredential, template.ExtraExtensions) {
+	if template.AllowDC && !template.IsCA && !oidInExtensions(oidExtensionDelegatedCredential, template.ExtraExtensions) && (template.KeyUsage&KeyUsageDigitalSignature != 0) {
 		ret[n].Id = oidExtensionDelegatedCredential
 		ret[n].Value, err = asn1.Marshal(asn1.NullRawValue)
 		if err != nil {