fix(tests): make `verify_cert_chain()` accept longer certificate chains
What the developer wrote
Authored by Ondřej Vejpustek
fix(tests): make `verify_cert_chain()` accept longer certificate chains
[no changelog]
What changed, and why it matters
This commit changes only a test helper function in the Trezor firmware test suite. It moves a common-name check to the beginning of certificate-chain verification so the function can handle chains longer than before. There is no change to the actual device firmware or to any security-critical runtime code.
No security action required. Treat as a normal test-maintenance change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
In tests/device_tests/certificate.py, verify_cert_chain() is updated to inspect the common name (CN) of certs[0] before iterating over the chain, instead of inspecting the loop variable cert after the loop. Previously, the post-loop check referenced the last certificate processed, which limited the function to chains where that behavior happened to work. The new placement makes the test work for longer chains. The change is purely in test infrastructure and does not alter device-side certificate validation logic.
Changed components
tests/device_tests/certificate.pyInspect captured patch +6 / −4
diff --git a/tests/device_tests/certificate.py b/tests/device_tests/certificate.py
index cfa77bdc..2330d54c 100644
--- a/tests/device_tests/certificate.py
+++ b/tests/device_tests/certificate.py
@@ -32,6 +32,12 @@ TROPIC_ROOT_PUBLIC_KEY = {
def verify_cert_chain(certs, model_name):
+ # Verify that the common name matches the Trezor model.
+ common_name = certs[0].subject.get_attributes_for_oid(x509.oid.NameOID.COMMON_NAME)[
+ 0
+ ]
+ assert common_name.value.startswith(model_name)
+
for i, (cert, ca_cert) in enumerate(zip(certs, certs[1:])):
assert cert.issuer == ca_cert.subject
@@ -69,10 +75,6 @@ def verify_cert_chain(certs, model_name):
cert.signature_algorithm_parameters,
)
- # Verify that the common name matches the Trezor model.
- common_name = cert.subject.get_attributes_for_oid(x509.oid.NameOID.COMMON_NAME)[0]
- assert common_name.value.startswith(model_name)
-
def check_signature_optiga(
signature: bytes,
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.