fido2-cred intermediate certs & displayName

[My1]

as far as I have tested fido2-cred only returns the leaf cert, is there any way to get the intermediate certs as well? makes it kinda hard to verify attestation for certs with intermediate but without AIA (especially some feitian-based devices seem to be affected), any way to get the intermediates?

Also there does not seem to be a way to set the displayName, rather than just the name of the credential, would be pretty neat to have that.

[LDVG]

Hi,

any way to get the intermediates?

Unfortunately, it's only possible to retrieve the leaf certificate through fido2-cred at this time. Since 1.15.0 it's at least possible for applications to retrieve any potential intermediates through the fido_cred_x5c_list_*() family of functions. We'll look into what we can do on the tooling side; I would imagine that we'd add have to add an option to output any potential intermediates to a separate file.

Also there does not seem to be a way to set the displayName, rather than just the name of the credential, would be pretty neat to have that.

Correct, request noted.

[My1]

"For applications to" , i assume you mean c or similarly compiled applications that can take advantage of DLLs right?

Also instead of writing to yet another file why not if a flag is set do the chain as a comma separated list or something?

[LDVG]

"For applications to" , i assume you mean c or similarly compiled applications that can take advantage of DLLs right?

Yes, our primary interface is the library itself.

Also instead of writing to yet another file why not if a flag is set do the chain as a comma separated list or something?

To not break compatibility with earlier versions.

[My1]

Wouldn't those just not set the flag though?

[LDVG]

Sorry, I misread. Sure, that's another approach.