待簽章憑證內容之 Linting（語法檢查）
Linting of to-be-signed Certificate content
Due to the complexity involved in implementing Certificate Profiles that conform to these Requirements, it is considered best practice for the CA to implement a Linting process to test the technical conformity of each to-be-signed artifact prior to signing it. When a Precertificate has undergone Linting, it is not necessary for the corresponding to-be-signed Certificate to also undergo Linting, provided that the CA has a technical control to verify that the to-be-signed Certificate corresponds to the to-be-signed Precertificate in the manner described by RFC 6962, Section 3.2.
由於實作符合本文件要求規定的憑證剖繪（Certificate Profiles）具有相當複雜性，憑證機構（Certification Authority，CA）於簽章每個待簽章物件前，實作 Linting 流程以檢查其技術符合性，被視為最佳實務。當預簽憑證（Precertificate）已完成 Linting 時，若 CA 具備技術控管措施，可依據 RFC 6962 第 3.2 節 所述方式驗證待簽章憑證與待簽章預簽憑證之間的對應關係，則相對應待簽章憑證無須進行 Linting。
Effective 2025-03-15, the CA SHALL implement such a Linting process.
自 2025-03-15 起，CA 應（SHALL）實作此類 Linting 流程。
Methods used to produce a certificate containing the to-be-signed Certificate content include, but are not limited to:
用於產生包含待簽章憑證內容之憑證的方法包括但不限於：
- Sign the
tbsCertificatewith a “dummy” Private Key whose Public Key component is not certified by a Certificate that chains to a publicly-trusted CA Certificate; or
- 使用「虛設（Dummy）」私密金鑰（Private Key）對
tbsCertificate進行簽章，而該私密金鑰的公開金鑰（Public Key）元件未經憑證鏈串鏈至公開信賴 CA 憑證之憑證所認證；或
- Specify a static value for the
signaturefield of the Certificate ASN.1 SEQUENCE.
- 於憑證 ASN.1 SEQUENCE 的
signature欄位指定固定值。
CAs MAY implement their own certificate Linting tools, but CAs SHOULD use the Linting tools that have been widely adopted by the industry (see https://cabforum.org/resources/tools/).
CA 得（MAY）實作自有的憑證 Linting 工具，但 CA 宜（SHOULD）使用業界廣泛採用的 Linting 工具（參見 https://cabforum.org/resources/tools/）。
CAs are encouraged to contribute to open-source Linting projects, such as by:
鼓勵 CA 對開源 Linting 專案做出貢獻，例如：
- creating new or improving existing lints,
- 新增 lint 或改善既有的 lint，
- reporting potentially inaccurate linting results as bugs,
- 將可能不正確的 linting 結果作為缺陷（bug）回報，
- notifying maintainers of Linting software of checks that are not covered by existing lints,
- 通知 Linting 軟體維護者現有 lint 尚未涵蓋的檢查項目，
- updating documentation of existing lints, and
- 更新既有 lint 的說明文件，以及
- generating test certificates for positive/negative tests of specific lints.
- 產製供特定 lint 進行正向／負向測試（positive/negative tests）的測試憑證。