Refactor Certificate handling #2169
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The PR prepares more changes for certificates when we incorporate DCL and mainly splits the CertificateManager's down into smaller pieces.
There was a problem hiding this comment.
Code Review
This pull request significantly refactors certificate handling by breaking down the monolithic CertificateManager into a more modular structure with specialized classes for different certificate types (RCAC, ICAC, NOC, PAA, PAI, DAC) and a new base class X509Base for common X.509 operations. This improves code organization, maintainability, and clarity. The changes also include updates to how certificates are generated, encoded, and verified across various parts of the protocol.
Key improvements:
- Introduction of
X509Basefor core X.509 logic, including CSR handling. - Specialized classes for operational certificates (
Rcac,Icac,Noc) and attestation certificates (Paa,Pai,Dac). - Centralized TLV and ASN.1 definitions.
- Updated tests to reflect the new structure.
I've identified a few areas for attention, including a couple of TODOs that should be addressed for completeness and a potential issue in ICAC key usage verification.
lauckhart
approved these changes
Jun 18, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The PR prepares more changes for certificates when we incorporate DCL and mainly splits the CertificateManager's down into smaller pieces.