jgrusewski 4c23f8c50c security(api-gateway): implement X.509 signature verification for mTLS ...

Replace the TODO stub in validate_certificate_chain with full
cryptographic chain-of-trust verification using x509-parser's ring-backed
verify feature:

1. Issuer CN matching -- client cert issuer must equal CA subject CN
2. CA validity period -- reject expired or not-yet-valid CA certificates
3. CA Basic Constraints -- verify the signer actually has cA=true
4. Cryptographic signature -- verify client cert TBS data signature
   against the CA's SubjectPublicKeyInfo (RSA/ECDSA/Ed25519 via ring)

Also enables the "verify" feature on x509-parser and extends the method
signature to accept ca_cert_pem for proper chain validation.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-21 19:19:35 +01:00

3.5 KiB

Raw Blame History

View Raw