crypto/x509: certificate validation issues

[joyantaDebnath]

Go version

Go-Crypto v1.21rc2

Output of go env in your module/workspace:

Go-Crypto v1.21rc2

What did you do?

1. The library allows empty DirectoryString (e.g., " ") in Distinguished name structures of Issuer and Subject name. (RFC 5280 non-compliant)
2. You should not allow 0 (zero) as certificate serial number. RFC 5280 says, "The serial number MUST be a positive integer assigned by the CA to each cer- tificate...CAs MUST force the serial Number to be a non-negative integer...Non- conforming CAs may issue certificates with serial numbers that are negative or zero. Certificate users SHOULD be prepared to gracefully handle such certificates."
3. Crypto allows presence of (version 3) extensions even if the certificate version is 1 or 2.

What did you see happen?

All certificates were accepted

What did you expect to see?

The library should reject such noncompliant certificates

[seankhliao]

does this reproduce against the latest released version?
do you have self contained reproducers to demonstrate the issue?

[joyantaDebnath]

I do not have self-contained reproducer, but I have sample certificates and the test harness.

certs.zip

This is the test harness I have used:

https://github.com/joyantaDebnath/ARMOR/blob/main/evaluation/Diff_test_setup/test-harness/go-crypto/test_verify.go

Yes, these are issues of the latest version as well.

[seankhliao]

We'd still need a root cert to test those certs.

[gopherbot]

Timed out in state WaitingForInfo. Closing.

(I am just a bot, though. Please speak up if this is a mistake or you have the requested information.)