Update crtd.py

Add the "CT_FLAG_NO_SECURITY_EXTENSION" extension flag value that permits to make a template vulnerable to ESC9.
fortalice · Jun 26, 2023 · cc7ceab · cc7ceab
1 parent f3e456e
commit cc7ceab
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/src/crtd.py b/src/crtd.py
@@ -17,6 +17,7 @@
 CT_FLAG_ALLOW_PREVIOUS_APPROVAL_KEYBASEDRENEWAL_VALIDATE_REENROLLMENT = 0x00010000
 CT_FLAG_ISSUANCE_POLICIES_FROM_REQUEST = 0x00020000
 CT_FLAG_SKIP_AUTO_RENEWAL = 0x00040000
+CT_FLAG_NO_SECURITY_EXTENSION = 0x00080000
 
 # 2.27 msPKI-Private-Key-Flag Attribute
 CT_FLAG_REQUIRE_PRIVATE_KEY_ARCHIVAL = 0x00000001
@@ -132,6 +133,7 @@
     CT_FLAG_ALLOW_PREVIOUS_APPROVAL_KEYBASEDRENEWAL_VALIDATE_REENROLLMENT: "ALLOW_PREVIOUS_APPROVAL_KEYBASEDRENEWAL_VALIDATE_REENROLLMENT",
     CT_FLAG_ISSUANCE_POLICIES_FROM_REQUEST: "ISSUANCE_POLICIES_FROM_REQUEST",
     CT_FLAG_SKIP_AUTO_RENEWAL: "SKIP_AUTO_RENEWAL",
+    CT_FLAG_NO_SECURITY_EXTENSION: "NO_SECURITY_EXTENSION",
 }
 
 MS_PKI_CERTIFICATE_NAME_FLAGS = {