crypto/x509: ParseCertificate error: PrintableString contains invalid character

[tonyjt]

Please answer these questions before submitting your issue. Thanks!

What version of Go are you using (go version)?

1.8

What operating system and processor architecture are you using (go env)?

mac

What did you do?

parse certificate

If possible, provide a recipe for reproducing the error.
A complete runnable program is good.
A link on play.golang.org is best.

https://play.golang.org/p/txkxbM56OI

What did you expect to see?

parse certificate success

What did you see instead?

asn1: syntax error: PrintableString contains invalid character

[tonyjt]

the certificate can be parsed in php...

`// isPrintable reports whether the given b is in the ASN.1 PrintableString set.
func isPrintable(b byte) bool {

bb := 'a' <= b && b <= 'z' ||
	'A' <= b && b <= 'Z' ||
	'0' <= b && b <= '9' ||
	'\'' <= b && b <= ')' ||
	'+' <= b && b <= '/' ||
	b == ' ' ||
	b == ':' ||
	b == '=' ||
	b == '?' ||
	// This is technically not allowed in a PrintableString.
	// However, x509 certificates with wildcard strings don't
	// always use the correct string type so we permit it.
	b == '*' ||
            //clone the asn1 and x509 packages and add this line for fixing the issue 
	b == 180 || b == 243 ||b == 193 ||b == 172 ||b == 181 ||b == 231 ||b == 208 ||b == 197**
return bb

}`

[davecheney]

An online certificate decoder suggest that the organisation name is not a valid PrintableString. A PrintableString may only contain certain characters, https://en.wikipedia.org/wiki/PrintableString, no Big-5, Punycode, or UTF-8.

How did you generate this certificate?

[tonyjt]

not my certificate...i can't change it

[davecheney]

I'm sorry, this certificate is not valid. Some implementations may accept it, but Go's strict implementation will not accept it.

[davecheney]

Which device or manufacturer generated this certificate? /cc @agl

[tonyjt]

I know it contains gbk characters, but the certificate is generated by another company...

[davecheney]

It was also generated 16 years ago, and expired 14 years ago. It's not valid even if it could be parsed.

[tonyjt]

............

[davecheney]

@tonyjt i'm just trying to help mate. Please be mindful that there is a live human on the other side of this discussion. I appreciate you are frustrated, but as a volunteer, it is not appropriate to direct that frustration at others.

[tonyjt]

I ask them to regenerate the certificate, but they say no...

[tonyjt]

looks like clone the asn1 and x509 packages is the only solution for me, appericate for you help

[davecheney]

Why won't they regenerate the certificate? It expired 14 years ago.

[mvdan]

I went to have a look at the RFC: https://www.ietf.org/rfc/rfc5280.txt

At page 113, it seems to say that X520OrganizationName can be any valid utf-8 string, unless I'm reading it wrong:

X520OrganizationName ::= CHOICE {
      teletexString     TeletexString
                          (SIZE (1..ub-organization-name)),
      printableString   PrintableString
                          (SIZE (1..ub-organization-name)),
      universalString   UniversalString
                          (SIZE (1..ub-organization-name)),
      utf8String        UTF8String
                          (SIZE (1..ub-organization-name)),
      bmpString         BMPString
                          (SIZE (1..ub-organization-name))  }

[davecheney]

Correct, but their certificate indicates that this is a PrintableString. They could choose to use another encoding, but they chose PrintableString.