Skip to content

crypto/x509: ParseRevocationList accepts invalid AKI extension in CRL #73030

Description

@onepeople158

Go version

go version go1.24.1 linux/amd64

Output of go env in your module/workspace:

CN=US,OU=US,O=US,L=US,ST=US,C=US
2025-01-01 00:00:00 +0000 UTC
2025-12-01 00:00:00 +0000 UTC
134026152402537916809419830168838464
1
Extension OID: 2.5.29.35
No Key Identifier
No Authority Cert Issuer
Authority Cert Serial Number (decimal): 123456

What did you do?

RFC 5280 specifies that the AKI extension, i.e., the Authority Key Identifier, is based on either keyIdentifier or a combination of both authorityCertIssuer and authorityCertSerialNumber. That is, authorityCertIssuer and authorityCertSerialNumber must either both appear together or both be None. However, I was able to successfully parse a CRL file with an AKI extension that only contains the authorityCertSerialNumber field using Go.

What did you see happen?

The AKI extension was successfully parsed, and the Authority Cert Serial Number value was printed.

What did you expect to see?

main.zip

Metadata

Metadata

Assignees

No one assigned

    Labels

    BugReportIssues describing a possible bug in the Go implementation.NeedsInvestigationSomeone must examine and confirm this is a valid issue and not a duplicate of an existing one.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions