RFC 5280 prohibits setting path lengths when not a CA.
From section 4.2.1.9
CAs MUST NOT include the pathLenConstraint field unless the cA
boolean is asserted and the key usage extension asserts the
keyCertSign bit.
This isn't restricted by the library, and means you can create invalid certificates. These are now failing checks in the latest version of OpenSSL (openssl/openssl#11456)
The relevant code is around
|
ret[n].Value, err = asn1.Marshal(basicConstraints{template.IsCA, maxPathLen}) |
Something like
if !template.IsCA {
maxPathLen = -1
}
would probably fix, but I'm not an expert in either Go or security, so don't want to change critical code.
RFC 5280 prohibits setting path lengths when not a CA.
From section 4.2.1.9
CAs MUST NOT include the pathLenConstraint field unless the cA
boolean is asserted and the key usage extension asserts the
keyCertSign bit.
This isn't restricted by the library, and means you can create invalid certificates. These are now failing checks in the latest version of OpenSSL (openssl/openssl#11456)
The relevant code is around
go/src/crypto/x509/x509.go
Line 1746 in 801cd7c
Something like
if !template.IsCA {
maxPathLen = -1
}
would probably fix, but I'm not an expert in either Go or security, so don't want to change critical code.