Skip to content

crypto/x509: ParseRevocationList accepts two AKI extensions #73051

Description

@onepeople158

Go version

go version go1.24.1 linux/amd64

Output of go env in your module/workspace:

Extension OID: 2.5.29.35
Key Identifier: ef69e0f7d51de699ecdc6dd0f7e2b95c64718335
No Authority Cert Issuer
No Authority Cert Serial Number
Extension OID: 2.5.29.20
Extension OID: 2.5.29.35
Key Identifier: ef69e0f7d51de699ecdc6dd0f7e2b95c64718335
No Authority Cert Issuer
No Authority Cert Serial Number

What did you do?

Go successfully parsed the AKI extension information from a CRL file that contains two AKI extensions. However, this test case does not comply with the RFC 5280 specification, which states that a specific extension can only have one instance.

What did you see happen?

Go successfully parsed the AKI extension information from a CRL file that contains two AKI extensions.

What did you expect to see?

crl_two_aki.zip

Metadata

Metadata

Assignees

No one assigned

    Labels

    NeedsInvestigationSomeone must examine and confirm this is a valid issue and not a duplicate of an existing one.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions