What version of Go are you using (go version)?
go1.14.6
Does this issue reproduce with the latest release?
Yes
What operating system and processor architecture are you using (go env)?
It reproduces on the playground.
What did you do?
https://play.golang.org/p/SBdIYeRXuOB verification succeeds for this certificate chain where the AIK keyid on the leaf certificate does not match the issuer ID.
What did you expect to see?
OpenSSL verify rejects this certificate chain due to the AIK KeyId and Issuer ID mismatch.
This can be verified with: openssl verify -CAfile ca.pem passing.pem
where ca.pem and passing.pem are the same x.509 certs that are in the playground example.
I expected Go x.509 Verify to also fail the chain.
What did you see instead?
Go x.509 Verify succeeds
What version of Go are you using (
go version)?go1.14.6
Does this issue reproduce with the latest release?
Yes
What operating system and processor architecture are you using (
go env)?It reproduces on the playground.
What did you do?
https://play.golang.org/p/SBdIYeRXuOB verification succeeds for this certificate chain where the AIK keyid on the leaf certificate does not match the issuer ID.
What did you expect to see?
OpenSSL verify rejects this certificate chain due to the AIK KeyId and Issuer ID mismatch.
This can be verified with: openssl verify -CAfile ca.pem passing.pem
where ca.pem and passing.pem are the same x.509 certs that are in the playground example.
I expected Go x.509 Verify to also fail the chain.
What did you see instead?
Go x.509 Verify succeeds