crypto/x509: UnknownAuthorityError should expose private Certificate

[rolandshoemaker]

Like CertificateInvalidError and HostnameError, it would be useful to expose the Certificate in UnknownAuthorityError as this provides important information for TLS/X509 testing tools.

This would also present a slightly more consistent API for the various X509 validation errors.

[bradfitz]

The information seems to be there:

// UnknownAuthorityError results when the certificate issuer is unknown                                                                                                                        
type UnknownAuthorityError struct {
        cert *Certificate
        // hintErr contains an error that may be helpful in determining why an                                                                                                                 
        // authority wasn't found.                                                                                                                                                             
        hintErr error
        // hintCert contains a possible authority certificate that was rejected                                                                                                                
        // because of the error in hintErr.                                                                                                                                                    
        hintCert *Certificate
}

So maybe it just needs an accessor method?

/cc @agl for opinions

[rolandshoemaker]

An accessor method would work, I was originally thinking of renaming cert->Certificate following the example of the other error types in the package but I didn't delve too deep into figuring out how much of a pain that change would be.

Either way I'm happy to write up a patch for this and sit on it until the freeze is over.

[rsc]

Ping @agl: Does it seem OK to add:

func (e *UnknownAuthorityError) Certificate() *Certificate { return e.cert } 

?

We can write the CL. Thanks.

[rsc]

Assuming yes given CertificateInvalidError and HostnameError. Too bad those spell Cert/Certificate differently. I'll go with Cert to match CertificateInvalidError.

[gopherbot]

CL https://golang.org/cl/32644 mentions this issue.