Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.Sign up
crypto/x509: AKID and issuer SKID are not checked to match #40679
What version of Go are you using (
Chromium allows mismatches, but during chain building prioritizes potential issuers with matching SKID/AKID above those with mismatches (see https://source.chromium.org/chromium/chromium/src/+/master:net/cert/internal/path_builder.cc;l=113?q=subject_key_identifier&ss=chromium%2Fchromium%2Fsrc&start=11). A similar approach to this is suggested in https://go-review.googlesource.com/c/go/+/232993.
Mozilla::pkix just ignores SKID/AKID matching entirely.