I have checked several examples and couldn't find out why my client certificate was invalid, until @FiloSottile pointed out that I'm trying to sign the cert with its own key.
A check is possible as we pass the public key.
|
func CreateCertificate(rand io.Reader, template, parent *Certificate, pub, priv interface{}) (cert []byte, err error) { |
Behaviour: after successful creation of certificate on connection checks fail with "x509: ECDSA verification failure"
Expected behaviour: CreateCertificate would return an error stating signing with own key will not be a successful tactic.
I have checked several examples and couldn't find out why my client certificate was invalid, until @FiloSottile pointed out that I'm trying to sign the cert with its own key.
A check is possible as we pass the public key.
go/src/crypto/x509/x509.go
Line 2084 in c3b9042
Behaviour: after successful creation of certificate on connection checks fail with "x509: ECDSA verification failure"
Expected behaviour: CreateCertificate would return an error stating signing with own key will not be a successful tactic.