Skip to content

crypto/x509: CheckSignatureFrom does not verify Issuer matches parent's Subject #14955

Description

@jsha
  1. What version of Go are you using (go version)?
    go version go1.6 linux/amd64
  2. What operating system and processor architecture are you using (go env)?
    GOARCH="amd64"
    GOBIN="/home/jsha/gopkg/bin"
    GOEXE=""
    GOHOSTARCH="amd64"
    GOHOSTOS="linux"
    GOOS="linux"
    GOPATH="/home/jsha/gopkg"
    GORACE=""
    GOROOT="/home/jsha/go1.6"
    GOTOOLDIR="/home/jsha/go1.6/pkg/tool/linux_amd64"
    GO15VENDOREXPERIMENT="1"
    CC="gcc"
    GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0"
    CXX="g++"
    CGO_ENABLED="1"
  3. What did you do?
    https://play.golang.org/p/4Q5wwbag_y
  4. What did you expect to see?
    Runs successfully, no errors

Per https://tools.ietf.org/html/rfc5280#page-73,

the path validation process verifies, among other
   things, that a prospective certification path (a sequence of n
   certificates) satisfies the following conditions:
(a)  for all x in {1, ..., n-1}, the subject of certificate x is
           the issuer of certificate x+1;

However, in the test code linked above, ee.CheckSignatureFrom(issuer2) returns a nil error, even though the subject of issuer2 is not equal to the issuer of ee.

  1. What did you see instead?
    Successfully verified signature on EE cert from issuer2, expected failure.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    FrozenDueToAgeNeedsInvestigationSomeone must examine and confirm this is a valid issue and not a duplicate of an existing one.

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions