another fix for the serial number generator

mirleft · Sep 29, 2024 · 0f178a1 · 0f178a1
1 parent 1d263f8
commit 0f178a1
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/lib/signing_request.ml b/lib/signing_request.ml
@@ -197,9 +197,14 @@ let sign signing_request
     | None ->
       (* we generate a positive integer, asn1-encoded: so if the high bit is
          set, we prepend a 0 byte *)
+      (* if it starts with 0x00 followed by 0xNN with NN <= 0x7f, we prepend
+         0x7f to make the integer valid *)
       let s = Mirage_crypto_rng.generate 10 in
-      if String.get_uint8 s 0 = 0x7f then
+      let start = String.get_uint8 s 0 in
+      if start > 0x7f then
         "\x00" ^ s
+      else if start = 0x00 && String.get_uint8 s 1 <= 0x7f then
+        "\x7f" ^ s
       else
         s
   in