ML-DSA Pure Cert Support by stenslae · Pull Request #251 · wolfSSL/wolfCLU

stenslae · 2026-06-16T17:43:00Z

Self-signed certificate (CA) and CSR generation
CA-based certificate signing
Certificate verification (leaf certificates validated directly against a provided CA)
Includes updated documentation and test coverage for ML-DSA workflows

Notes:

X.509 extensions are currently not fully supported for ML-DSA
wolfssl-x509(1) -text cannot fully decode ML-DSA SubjectPublicKey
ML-DSA verification is simplified, ignored untrusted intermediates, no CRL or revocation checking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #251

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #251

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #251

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #251

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot · 2026-06-16T22:16:42Z

+    int csrIsCA = wolfSSL_X509_get_isCA(x509);
+    int ku = wolfSSL_X509_get_keyUsage(x509);
+
+    if (csrIsCA && caCert != NULL) {


🟠 [Medium] ML-DSA CA signing honors CSR-requested CA:TRUE / keyUsage · Certificate validation bypass

When an ML-DSA CA signs a CSR, cert->isCA and cert->keyUsage are taken directly from the requester's CSR via wolfSSL_X509_get_isCA/wolfSSL_X509_get_keyUsage. A CSR asserting basicConstraints CA:TRUE causes the CA to issue a CA-capable (sub-CA) certificate to the requester.

Fix: For CA-issued (non-self-signed) certs, set basicConstraints/keyUsage from CA policy/config rather than the CSR, defaulting to CA:FALSE.

added ml-dsa pure self signed

7873126

stenslae requested a review from wolfSSL-Fenrir-bot June 16, 2026 17:43

stenslae self-assigned this Jun 16, 2026

stenslae force-pushed the ml-dsa-cert branch from 009fb30 to 8e28b3e Compare June 16, 2026 17:51

wolfSSL-Fenrir-bot reviewed Jun 16, 2026

View reviewed changes

Comment thread src/x509/clu_mldsa.c Outdated

Comment thread src/sign-verify/clu_x509_verify.c