crypto/x509: ParseCertificate duplicate extensions errors should include OID of the affected extension

[Techassi]

I recently ran into the issue that generated X.509 certificates very rejected by Go due to containing duplicate extensions. The exact extension was not reported in the error message, which made the debugging process rather complicated - it required manual changes in the standard library. The current error message reads: x509: certificate contains duplicate extensions.

Therefore, I would like to propose to change the error message to include the detected duplicate OID. The error message could then look like: x509: certificate contains duplicate extension {oid}. Feel free to suggest a different error message format.

I'm also happy to contribute the required changes in a separate PR if it is decided to move forward.

---

References

• Issue proposing the duplicate detection: crypto/x509: ParseCertificate and ParseCertificateRequest should return an error when there are duplicate x509 extensions #50988
• Original CL: https://go-review.googlesource.com/c/go/+/383215

[cherrymui]

cc @FiloSottile @rolandshoemaker @golang/security

[Techassi]

Just checking in if there is anything I can help with to move this issue forward?

[rolandshoemaker]

If you'd like to send a CL for this I'd be happy to review it, otherwise I'll try to get to it before the freeze for 1.23.

[Techassi]

Alright, happy to do it :) I will send it in asap.

[gopherbot]

Change https://go.dev/cl/583096 mentions this issue: crypto/x509: include OID in duplicate extension error message