From 888917358110125217392342e1d7e68d30eeed33 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Thu, 14 Nov 2013 08:30:42 +0000
Subject: [PATCH] X.509 certificate check on registered entities: nothing
 shorter than 1024 bits.

---
 mdx/uk/beans.xml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/mdx/uk/beans.xml b/mdx/uk/beans.xml
index 41827635..285c1a28 100644
--- a/mdx/uk/beans.xml
+++ b/mdx/uk/beans.xml
@@ -420,6 +420,17 @@
                 <ref bean="mdui_dn_en_match"/>
                 <ref bean="check_dup_display"/>
                 
+                <bean parent="X509CertificateValidationStage"
+                    p:id="checkCertificates">
+                    <property name="validators">
+                        <list>
+                            <!-- Error on RSA key length less than 1024 bits. -->
+                            <bean parent="X509CertificateRSAKeyLengthValidator"
+                                p:warningBoundary="0" p:errorBoundary="1024"/>
+                        </list>
+                    </property>
+                </bean>
+
                 <!-- failure of any check on registered metadata is fatal -->
                 <ref bean="errorTerminatingFilter"/>
             </list>