From 7fe9ab39b6d1c53009cb1e77c3ad78f23bbcb7ff Mon Sep 17 00:00:00 2001 From: Pol Henarejos Date: Sat, 15 Aug 2026 01:36:07 +0200 Subject: [PATCH] Ensure PIV certificate serials are canonical Signed-off-by: Pol Henarejos --- src/openpgp/piv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/openpgp/piv.c b/src/openpgp/piv.c index 5fbbc5d..71a2004 100644 --- a/src/openpgp/piv.c +++ b/src/openpgp/piv.c @@ -188,7 +188,7 @@ static int x509_create_cert(void *pk_ctx, uint8_t algo, uint8_t slot, bool attes mbedtls_x509write_crt_set_validity(&ctx, "20240325000000", "20741231235959"); uint8_t serial[20]; random_fill_buffer(BYTE_ARRAY(serial, sizeof(serial))); - serial[0] &= 0x7F; + serial[0] = (serial[0] & 0x7F) | 0x01; mbedtls_x509write_crt_set_serial_raw(&ctx, serial, sizeof(serial)); mbedtls_pk_context skey, ikey; mbedtls_ecdsa_context actx; // attestation key