Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

crypto/x509: ensure CreateCertificate won't generate unparsable certificates #24156

FiloSottile opened this issue Feb 27, 2018 · 5 comments
help wanted NeedsFix Testing


Copy link

@FiloSottile FiloSottile commented Feb 27, 2018

CreateCertificate should return an error instead of generating a certificate that will fail ParseCertificate. We should check that's the case and maybe test or enforce this.

See #23995.

@titanous titanous added the NeedsFix label Feb 27, 2018
@titanous titanous added this to the Go1.11 milestone Feb 27, 2018
Copy link

@jlhawn jlhawn commented Mar 1, 2018

Do you think it would have been a better idea to first have a minor release of Go which adds the new validation process to CreateCertificate and then, in a later minor release, start enforcing that validation during ParseCertificate? That way, at least, many people wouldn't be in the situation like I am in now where a go1.10-bulit program can't load the certificates generated by the previous version of that same program.

Copy link

@odeke-em odeke-em commented Jul 20, 2018

@jlhawn oh, sorry to hear that and that we haven't addressed your comment, yet Go1.11 is coming up fast. Would you mind producing a repro here that demonstrates the incompatibility between Go1.10 can't load certificates from previous versions? If so, that's a breaking change, which I'd suspect would perhaps violate the compatibility promise.

Copy link

@rsc rsc commented Aug 17, 2018

Moving to Go 1.12.

@rsc rsc removed this from the Go1.11 milestone Aug 17, 2018
@rsc rsc added this to the Go1.12 milestone Aug 17, 2018
Copy link

@jlhawn jlhawn commented Sep 4, 2018

@FiloSottile Sorry for the (very) late reply. It looks like my concerns are already addressed in the latest go 1.10 release with this patch which ignores invalid email address subject names in certificates.

@andybons andybons removed this from the Go1.12 milestone Feb 12, 2019
@andybons andybons added this to the Go1.13 milestone Feb 12, 2019
@andybons andybons removed this from the Go1.13 milestone Jul 8, 2019
@andybons andybons added this to the Go1.14 milestone Jul 8, 2019
@FiloSottile FiloSottile added help wanted Testing labels Sep 30, 2019
@FiloSottile FiloSottile removed this from the Go1.14 milestone Sep 30, 2019
@FiloSottile FiloSottile added this to the Unplanned milestone Sep 30, 2019
Copy link
Contributor Author

@FiloSottile FiloSottile commented Sep 30, 2019

To be clear, it would be nice to fuzz CreateCertificate with various template values, and check that if CreateCertificate succeeds, ParseCertificate does as well, ideally with matching fields.

This is up for anyone who wants to take it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
help wanted NeedsFix Testing
None yet

No branches or pull requests

6 participants