INNER CODE UNIT · Go

VerifyAttestation

go-piv/go-ykpiv · attestation.go:142

func VerifyAttestation(attestationCert, attestedCert *x509.Certificate) ([][]*x509.Certificate, error) {
	options := x509.VerifyOptions{
		Roots:         x509.NewCertPool(),
		Intermediates: x509.NewCertPool(),
	}

	for _, yubicoPivAttestationCA := range yubicoPivAttestationCAs {
		block, _ := pem.Decode(yubicoPivAttestationCA)
		caCert, err := x509.ParseCertificate(block.Bytes)
		if err != nil || !caCert.IsCA {
			return nil, fmt.Errorf("ykpiv: INTERNAL ERROR: Attestation Root PEM is wrong!")
		}
		if bytes.Equal(caCert.RawIssuer, caCert.RawSubject) {
			options.Roots.AddCert(caCert)
		} else {
			options.Intermediates.AddCert(caCert)
		}
	}

View source record →