crypto/x509: ensure CreateCertificate won't generate unparsable certificates

[FiloSottile]

CreateCertificate should return an error instead of generating a certificate that will fail ParseCertificate. We should check that's the case and maybe test or enforce this.

See #23995.

[jlhawn]

Do you think it would have been a better idea to first have a minor release of Go which adds the new validation process to CreateCertificate and then, in a later minor release, start enforcing that validation during ParseCertificate? That way, at least, many people wouldn't be in the situation like I am in now where a go1.10-bulit program can't load the certificates generated by the previous version of that same program.

[odeke-em]

@jlhawn oh, sorry to hear that and that we haven't addressed your comment, yet Go1.11 is coming up fast. Would you mind producing a repro here that demonstrates the incompatibility between Go1.10 can't load certificates from previous versions? If so, that's a breaking change, which I'd suspect would perhaps violate the compatibility promise.

[rsc]

Moving to Go 1.12.

[jlhawn]

@FiloSottile Sorry for the (very) late reply. It looks like my concerns are already addressed in the latest go 1.10 release with this patch which ignores invalid email address subject names in certificates.