diff --git a/v3/lint/base.go b/v3/lint/base.go index 499810e74..f1df4bbac 100644 --- a/v3/lint/base.go +++ b/v3/lint/base.go @@ -89,6 +89,8 @@ type LintMetadata struct { // true but with NotBefore >= IneffectiveDate. This check is bypassed if // IneffectiveDate is zero. Please see CheckEffective for more information. IneffectiveDate time.Time `json:"-"` + + OverrideFrameworkFilter bool } // A Lint struct represents a single lint, e.g. @@ -218,11 +220,13 @@ func (l *CertificateLint) CheckEffective(c *x509.Certificate) bool { // CheckEffective() // Execute() func (l *CertificateLint) Execute(cert *x509.Certificate, config Configuration) *LintResult { - if l.Source == CABFBaselineRequirements && !util.IsServerAuthCert(cert) { - return &LintResult{Status: NA} - } - if l.Source == CABFSMIMEBaselineRequirements && !((util.IsEmailProtectionCert(cert) && util.HasEmailSAN(cert)) || util.IsSMIMEBRCertificate(cert)) { - return &LintResult{Status: NA} + if !l.OverrideFrameworkFilter { + if l.Source == CABFBaselineRequirements && !util.IsServerAuthCert(cert) { + return &LintResult{Status: NA} + } + if l.Source == CABFSMIMEBaselineRequirements && !((util.IsEmailProtectionCert(cert) && util.HasEmailSAN(cert)) || util.IsSMIMEBRCertificate(cert)) { + return &LintResult{Status: NA} + } } lint := l.Lint() err := config.MaybeConfigure(lint, l.Name) diff --git a/v3/lints/cabf_br/lint_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth.go b/v3/lints/cabf_br/lint_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth.go index ecc0d8cba..b5b2995c3 100644 --- a/v3/lints/cabf_br/lint_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth.go +++ b/v3/lints/cabf_br/lint_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth.go @@ -28,9 +28,10 @@ func init() { Name: "e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth", Description: "OCSP signing Certificate MUST contain an extension of type id-pkixocsp-nocheck, as" + " defined by RFC6960", - Citation: "BRs: 4.9.9", - Source: lint.CABFBaselineRequirements, - EffectiveDate: util.CABEffectiveDate, + Citation: "BRs: 4.9.9", + Source: lint.CABFBaselineRequirements, + EffectiveDate: util.CABEffectiveDate, + OverrideFrameworkFilter: true, }, Lint: NewOCSPIDPKIXOCSPNocheckExtNotIncludedServerAuth, })