Question about wc_SignCert API: failure code -226 when using a CA:FALSE certificate

[wuhuyibeijiu]

Version

5.7.2

Description

Hi,

I'm testing wolfSSL's certificate signing behavior. I have a certificate with basicConstraints=CA:FALSE but keyUsage=keyCertSign. I tried to use it as the issuer to sign a child certificate with wc_SignCert.The signing fails and returns "Failure code was -226". I'm not sure what this error means.

My questions are:

1. Is wc_SignCert the correct API for this use case? If not, what should I use instead?
2. If I'm using the correct API, what does error code -226 mean specifically?

I've attached my test code (certgen_test_ca_false.c).
Thanks!

[embhorn]

Hello @wuhuyibeijiu

Thanks for contacting wolfSSL Support.

The attachment failed to upload, but I'll try to help address your questions.

The -226 error means their issuer cert violates RFC 5280 §4.2.1.9
wc_SignCert IS the correct API — the issue is the issuer certificate, not the API choice
You can either: (a) regenerate the issuer cert with CA:TRUE, or (b) add #define ALLOW_INVALID_CERTSIGN to the build config if you must use non-compliant certs.
Note that this enforcement was intentionally added for RFC compliance and is not a bug.

Let us know if there are questions.

Kind regards,
@embhorn