crypto/x509: invalid RDNSequence: invalid attribute value: unsupported string type: 18

[mic6090]

What version of Go are you using (go version)?

$ go version
go version go1.17 windows/amd64

Does this issue reproduce with the latest release?

Yes, the latest release has regression

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
set GO111MODULE=
set GOARCH=amd64
set GOBIN=
set GOCACHE=C:\Users\michael\AppData\Local\go-build
set GOENV=C:\Users\michael\AppData\Roaming\go\env
set GOEXE=.exe
set GOEXPERIMENT=
set GOFLAGS=
set GOHOSTARCH=amd64
set GOHOSTOS=windows
set GOINSECURE=
set GOMODCACHE=C:\Users\michael\go\pkg\mod
set GONOPROXY=
set GONOSUMDB=
set GOOS=windows
set GOPATH=C:\Users\michael\go
set GOPRIVATE=
set GOPROXY=https://proxy.golang.org,direct
set GOROOT=c:\go
set GOSUMDB=sum.golang.org
set GOTMPDIR=
set GOTOOLDIR=c:\go\pkg\tool\windows_amd64
set GOVCS=
set GOVERSION=go1.17
set GCCGO=gccgo
set AR=ar
set CC=gcc
set CXX=g++
set CGO_ENABLED=1
set GOMOD=C:\src\go\apitest\go.mod
set CGO_CFLAGS=-g -O2
set CGO_CPPFLAGS=
set CGO_CXXFLAGS=-g -O2
set CGO_FFLAGS=-g -O2
set CGO_LDFLAGS=-g -O2
set PKG_CONFIG=pkg-config
set GOGCCFLAGS=-m64 -mthreads -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=C:\Users\michael\AppData\Local\Temp\go-build1442540087=/tmp/go-build -gno-record-gcc-switches

What did you do?

https://play.golang.org/p/gVmDQZr638l

What did you expect to see?

nil (no error when parse certificate)

What did you see instead?

x509: invalid RDNSequence: invalid attribute value: unsupported string type: 18

go 1.17 encoding/x509 parser does not know about Numeric String (type 18 asn.1) while previous version of Golang does.

[seankhliao]

cc @FiloSottile @rolandshoemaker

[gopherbot]

Change https://golang.org/cl/347034 mentions this issue: crypto/x509: support NumericString in DN components

[mic6090]

golang.org/x/crypto/cryptobyte, golang.org/x/crypto/cryptobyte/asn1 does not support tag 18 type while standard library encoding/asn1 does.
go1.16 does not have this issue - why go1.17 should use outdated code from golang.org/x/crypto/cryptobyte[/asn1] ?

[konart]

Same problem here, example: https://play.golang.org/p/-1pDx9dZNpm

[Theo730]

join the question
solved the problem like this :
in go-1.17.3/src/vendor/golang.org/x/crypto/cryptobyte/asn1/asn1.go
added NumericString = Tag(18)
in go-1.17.3/src/crypto/x509/parser.go
added
func isNumeric(b byte) bool { return '0' <= b && b <= '9' }
and processing
case cryptobyte_asn1.NumericString: for _, b := range value { if !isNumeric(b) { return "", errors.New("invalid NumrticString") } } return string(value), nil
in
func parseASN1String(tag cryptobyte_asn1.Tag, value []byte) (string, error) { switch tag {

[rittneje]

@seankhliao @FiloSottile This is a regression from 1.16 that remains broken even in the latest head. Can the linked CL please be merged, and backported to 1.17?

[rittneje]

@seankhliao @FiloSottile @katiehockman @rolandshoemaker @agl

[rolandshoemaker]

@gopherbot please open a backport issue for 1.17. This is a regression in the parser rewrite that prevents parsing some certificates.

[gopherbot]

Backport issue(s) opened: #51000 (for 1.17).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://golang.org/wiki/MinorReleases.