What version of Go are you using (go version)?
go version: 1.17.6
Does this issue reproduce with the latest release? Yes
What operating system and processor architecture are you using (go env)?
go env Output
$ go env
go version go1.17.6 windows/amd64
PS C:\Users\private\GolandProjects\awesomeProject> go env
set GO111MODULE=auto
set GOARCH=amd64
set GOBIN=
set GOCACHE=C:\Users\private\AppData\Local\go-build
set GOENV=C:\Users\private\AppData\Roaming\go\env
set GOEXE=.exe
set GOEXPERIMENT=
set GOFLAGS=
set GOHOSTARCH=amd64
set GOHOSTOS=windows
set GOINSECURE=
set GOMODCACHE=C:\Users\private\go\pkg\mod
set GONOPROXY=
set GONOSUMDB=
set GOOS=windows
set GOPATH=C:\Users\private\go
set GOPRIVATE=
set GOPROXY=https://proxy.golang.org,direct
set GOROOT=C:\Program Files\Go
set GOSUMDB=sum.golang.org
set GOTMPDIR=
set GOTOOLDIR=C:\Program Files\Go\pkg\tool\windows_amd64
set GOVCS=
set GOVERSION=go1.17.6
set GCCGO=gccgo
set AR=ar
set CC=gcc
set CXX=g++
set CGO_ENABLED=1
set GOMOD=C:\Users\private\GolandProjects\awesomeProject\go.mod
set CGO_CFLAGS=-g -O2
set CGO_CPPFLAGS=
set CGO_CXXFLAGS=-g -O2
set CGO_FFLAGS=-g -O2
set CGO_LDFLAGS=-g -O2
set PKG_CONFIG=pkg-config
set GOGCCFLAGS=-m64 -mthreads -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=C:\Users\private\AppData\Local\Temp\go-build554477491=/tmp/go-build -gno-record-gcc-switches
What did you do?
Create a malformed CSR with multiple SAN extensions manually. Then I tried to parse the malformed CSR.
Proof of Concepts:
What did you expect to see?
Per RFC5280, Section 4.2 I expected to see a failure in parsing CSRs and Certificates that contain any specific extension more than once.
A certificate MUST NOT include more than one instance of a particular extension.
What did you see instead?
Go did not create any errors parsing malformed CSRs and Certificates.
What version of Go are you using (
go version)?Does this issue reproduce with the latest release? Yes
What operating system and processor architecture are you using (
go env)?go envOutputWhat did you do?
Create a malformed CSR with multiple SAN extensions manually. Then I tried to parse the malformed CSR.
Proof of Concepts:
What did you expect to see?
Per RFC5280, Section 4.2 I expected to see a failure in parsing CSRs and Certificates that contain any specific extension more than once.
What did you see instead?
Go did not create any errors parsing malformed CSRs and Certificates.