crypto/tls: RequireAndVerifyClientCert not rejecting bad client cert on 1.10 that it was on 1.9

[psanford]

What version of Go are you using (go version)?

$ go version
go version go1.10 linux/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

GOARCH="amd64"
GOBIN=""
GOCACHE="/home/psanford/.cache/go-build"
GOEXE=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/home/psanford/projects/nearbuy/storenet/go"
GORACE=""
GOROOT="/usr/local/go"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build417289417=/tmp/go-build -gno-record-gcc-switches"

What did you do?

Ran the following program on 1.9.4 and 1.10:

https://play.golang.org/p/gt67v9Ih7Te

The https server is requiring client certs with RequireAndVerifyClientCert. The client is using a weird (bad?) cert that has ExtKeyUsage: x509.ExtKeyUsageServerAuth instead of x509.ExtKeyUsageClientAuth.

What did you expect to see?

On 1.9.4 the https server rejects the weird client cert:

2018/02/17 02:19:06 http: TLS handshake error from 127.0.0.1:57370: tls: failed to verify client's certificate: x509: certificate specifies an incompatible key usage
panic: Get https://127.0.0.1:4443: remote error: tls: bad certificate

What did you see instead?

On 1.10 it accepts the client cert.

response status: 200 OK
Hello, "/"
done

[bradfitz]

/cc @agl @FiloSottile

[agl]

It's because we have this mess to try and work around the fact that CAs have repeatedly botched extended key usage in the past. It was made by running lots of tests on the CT logs and ServerAuth is counted as sufficient to allow ClientAuth. But I think there's a fair argument to be made that, while that might be needed when checking a chain, we don't need it when checking elements of the leaf cert. (Although we do need other exceptions then.)

The best evidence for that is probably that we evidently didn't previously allow it and that didn't break the world.

[gopherbot]

Change https://golang.org/cl/96379 mentions this issue: crypto/x509: tighten EKU checking for requested EKUs.

[FiloSottile]

Reopening to consider for backport to 1.10.1. (Is this how it works these days?)

[liggitt]

Reopening to consider for backport to 1.10.1. (Is this how it works these days?)

given that 1.10.0 validates plain serving certificates as if they were client certificates, I'd expect a pick to 1.10.x