crypto/tls: internal error when connecting to site with abnormaly large certificate

[jvehent]

https://10000-sans.badssl.com is a test site that serves a certificate with 10,000 SAN records for the purpose of breaking TLS clients. Go is unable to open a connection to this site, and breaks with the error:

$ go run https_break.go 
panic: Get https://10000-sans.badssl.com: local error: internal error

goroutine 1 [running]:
main.main()
    /home/ulfr/git/go-toybox/https_break.go:8 +0x6e

goroutine 17 [syscall, locked to thread]:
runtime.goexit()
    /usr/lib/go/src/runtime/asm_amd64.s:1696 +0x1
exit status 2

Source code is

package main

import "net/http"

func main() {
    _, err := http.Get("https://10000-sans.badssl.com")
    if err != nil {
        panic(err)
    }
}

I would like for this to work, but I can understand Go refusing to open a connection with such an unusual certificate. If so, maybe the failure should be enforced by a policy and the error message explicit?

[rsc]

/cc @agl

[agl]

Certainly the error message could be better, which is hopefully addressed in https://go-review.googlesource.com/#/c/20547/.

However, did you expect 10000-sans.badssl.com to work? It doesn't work in OpenSSL nor Chrome at least. I'm unsure whether this is something that reals sites would want to do, and thus should be supported, or whether our existing handshake message limit is still reasonable.

[gopherbot]

CL https://golang.org/cl/20547 mentions this issue.

[jvehent]

I don't think there is a valid use case for certificates that large (yet? ever?). I was essentially curious about Go's behavior shortly after the badssl site was setup. Thanks for fixing the error message 👍