crypto/x509: more descriptive error message for unsupported algorithms such as MD5 with RSA

[mvanotti]

In http://golang.org/src/crypto/x509/x509.go?s=21072:21171#L611 that algorithm is not listed.

Should it be listed? Is it because it is considered insecure?

I've found a certificate issued with the MD5withRSA signature algorithm (used only for testing) but finding the error was really hard. It would be nice to have a better error description for this kind of failures.

[minux]

Yes, it's insecure. And I think major browsers will also reject it.

[mvanotti]

I see.

In that case, it would be better to have a more descriptive error than..

failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "x509: cannot verify signature: algorithm unimplemented" while trying to verify candidate authority certificate "testCA")

"algorithm unimplemented".. The algorithm is implemented, it is not supported because it is considered insecure. Which algorithm? In which part of the chain? Which function failed?

Tracking the error took me a while..

[gopherbot]

CL https://golang.org/cl/17380 mentions this issue.