crypto/x509: ParseCertificate fails to parse certificates with a compressed EC public key

[austin-jadlowiec]

Go version

go version go1.23.5 linux/amd64

Output of go env in your module/workspace:

GO111MODULE=''
GOARCH='amd64'
GOBIN=''
GOCACHE='/home/austin/.cache/go-build'
GOENV='/home/austin/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/home/austin/.go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/home/austin/.go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/lib/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='local'
GOTOOLDIR='/usr/lib/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.23.5'
GODEBUG=''
GOTELEMETRY='local'
GOTELEMETRYDIR='/home/austin/.config/go/telemetry'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/dev/null'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefi
x-map=/tmp/go-build2413653899=/tmp/go-build -gno-record-gcc-switches'

What did you do?

Background

We have an existing EC (prime256v1) root CA certificate that we need to use with some Go infrastructure, however it has a compressed key as its subject public key. Resigning the certificate is a difficult operation due to the private key being placed in a dedicated hardware security module (HSM).

This certificate is able to be successfully parsed and validated by other crypto stacks (namely openssl and Google Chrome).

I ultimately noticed that this comes from the fact that only elliptic.Unmarshal is called in parsePublicKey, instead of elliptic.UnmarshallCompressed in the case the pubkey is compressed.

go/src/crypto/x509/parser.go

Line 294 in 116b823

x, y := elliptic.Unmarshal(namedCurve, der)

Reproduction

Generating a Compressed Pubkey Certificate

#!/bin/sh
# generate a prime256v1 private key
openssl ecparam -genkey -name prime256v1 -out key.pem
# generate a compressed public key from the private key
openssl ec -in key.pem -pubout -out key.pub -conv_form compressed
# generate the certificate using the compressed public key
openssl x509 -new -sha256 -key key.pem -force_pubkey key.pub -out ca.crt \
    -subj '/C=US/ST=Illinois/L=Chicago/CN=test.com'

# print out the certificate, notice leading 02 or 03 in public key signifying compressed form
openssl x509 -in ca.crt -noout -text

Parsing the Certificate from Go

package main

import (
        "crypto/x509"
        "encoding/pem"
        "fmt"
        "io/ioutil"
        "log"
)

func main() {
        certFile, err := ioutil.ReadFile("ca.crt")
        if err != nil {
                log.Fatalf("Error reading certificate file: %v", err)
        }

        // Decode the PEM encoded certificate
        block, _ := pem.Decode(certFile)
        if block == nil || block.Type != "CERTIFICATE" {
                log.Fatalf("Failed to decode PEM certificate")
        }

        // Parse the certificate
        cert, err := x509.ParseCertificate(block.Bytes)
        if err != nil {
                log.Fatalf("Error parsing certificate: %v", err)
        }

        fmt.Printf("Certificate imported successfully:")
        fmt.Printf("  Subject: %v\n", cert.Subject)
}

What did you see happen?

The output of the above program is the following when using a certificate with a compressed subject pubkey:

2025/04/02 17:18:00 Error parsing certificate: x509: failed to unmarshal elliptic curve point
exit status 1

What did you expect to see?

I expect to see the same thing as for certificates with an uncompressed subject pubkey, EG:

Certificate imported successfully:  Subject: CN=test.com,L=Chicago,ST=Illinois,C=US

Note: This can be replicated by removing -conv_form compressed from the shell script above and regenerating the certificate with an uncompressed subject pubkey.

[gabyhelp]

Related Issues

• crypto/x509: invalid certificate policies #65990 (closed)
• x/crypto/cryptobyte: "x509: invalid key usage" error caused by strict asn1 bit string parsing #70242
• crypto/x509: ParsePKCS1PublicKey expects invalid key format #29141 (closed)
• x509.ParsePKIXPublicKey failed to parse X.509 DER format public key #69012 (closed)
• x/crypto/ssh: unable to parse certificates #45010 (closed)
• crypto/x509: ParseCertificate and ParseCertificates return different errors with a single bad certificate supplied #43113
• crypto/x509: unable to parse certificate with rsassa-pss algorithm #48314
• crypto/x509: verify checks root certificate #28971
• crypto/tls: LoadX509KeyPair fails to parse some keys, yet they are accepted by OpenSSL #21807 (closed)
• crypto/x509: ParseCertificate fails with "net/url: invalid userinfo" #69930 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[sigmavirus24]

Implementations of Elliptic Curve Cryptography according to this
document MUST support the uncompressed form and MAY support the
compressed form of the ECC public key.  The hybrid form of the ECC
public key from [X9.62] MUST NOT be used.

https://www.rfc-editor.org/rfc/rfc5480#section-2.2

Strictly this isn't required by Go, but I don't think it's an unreasonable ask. I think what would be ideal. Best though is that

   The first octet of the OCTET STRING indicates whether the key is
   compressed or uncompressed.  The uncompressed form is indicated
   by 0x04 and the compressed form is indicated by either 0x02 or
   0x03 (see 2.3.3 in [[SEC1](https://www.rfc-editor.org/rfc/rfc5480#ref-SEC1)]).  The public key MUST be rejected if
   any other value is included in the first octet.

So it can be detected. I'd be happy to send a CL for this

[sigmavirus24]

For verification of RFC 5480, I modified the script above:

#!/bin/sh
# generate a prime256v1 private key
openssl ecparam -genkey -name prime256v1 -out key.pem
# generate a compressed public key from the private key
openssl ec -in key.pem -pubout -out compressed-key.pub -conv_form compressed
# generate the certificate using the compressed public key
openssl x509 -new -sha256 -key key.pem -force_pubkey compressed-key.pub -out compressed-ca.crt     -subj '/C=US/ST=Illinois/L=Chicago/CN=test.com'

# print out the certificate, notice leading 02 or 03 in public key signifying compressed form
openssl x509 -in compressed-ca.crt -noout -text

# generate a uncompressed public key from the private key
openssl ec -in key.pem -pubout -out uncompressed-key.pub
# generate the certificate using the uncompressed public key
openssl x509 -new -sha256 -key key.pem -force_pubkey uncompressed-key.pub -out uncompressed-ca.crt     -subj '/C=US/ST=Illinois/L=Chicago/CN=test.com'

# print out the certificate, notice leading 02 or 03 in public key signifying compressed form
openssl x509 -in uncompressed-ca.crt -noout -text

The output I got included the public keys for compressed and uncompressed like so:

        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    02:d8:3d:5d:77:a7:db:1f:a5:1f:02:55:8c:99:37:
                    80:ff:7b:7c:b8:dc:67:52:78:01:fb:33:a9:4a:18:
                    4b:f2:47
                ASN1 OID: prime256v1
                NIST CURVE: P-256

---
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    04:d8:3d:5d:77:a7:db:1f:a5:1f:02:55:8c:99:37:
                    80:ff:7b:7c:b8:dc:67:52:78:01:fb:33:a9:4a:18:
                    4b:f2:47:7b:e3:95:ff:51:15:ed:99:26:c0:ac:6b:
                    35:93:cb:60:ec:16:95:80:80:54:da:de:8b:ed:cd:
                    5a:12:26:87:e2
                ASN1 OID: prime256v1
                NIST CURVE: P-256

So that initial octect should be a good signal for us to do this. I'm almost wondering if it makes the most sense for the.

Using the script, I have a very small program here with easily fixed inputs:

module go.dev/bug/73142

go 1.23.8

package main

import (
	"crypto/x509"
	"encoding/pem"
	"fmt"
)

const (
	uncompressedCertPEM = `-----BEGIN CERTIFICATE-----
MIIBrjCCAVOgAwIBAgIUXybjYdxyA77bHWvlVKg2OPqv0O8wCgYIKoZIzj0EAwIw
RTELMAkGA1UEBhMCVVMxETAPBgNVBAgMCElsbGlub2lzMRAwDgYDVQQHDAdDaGlj
YWdvMREwDwYDVQQDDAh0ZXN0LmNvbTAeFw0yNTA1MDcwMTQ3NTlaFw0yNTA2MDYw
MTQ3NTlaMEUxCzAJBgNVBAYTAlVTMREwDwYDVQQIDAhJbGxpbm9pczEQMA4GA1UE
BwwHQ2hpY2FnbzERMA8GA1UEAwwIdGVzdC5jb20wWTATBgcqhkjOPQIBBggqhkjO
PQMBBwNCAATYPV13p9sfpR8CVYyZN4D/e3y43GdSeAH7M6lKGEvyR3vjlf9RFe2Z
JsCsazWTy2DsFpWAgFTa3ovtzVoSJofioyEwHzAdBgNVHQ4EFgQUdVUSsUn4PGIZ
cRVOHQYrWdRUvf8wCgYIKoZIzj0EAwIDSQAwRgIhAIU7c2OH1d5DcwspdG4pHM4V
Uc9pT+PXm0EBUReRApfaAiEAgjsG2IowNENpRHTEntyl4YP+XcRlKb9dWlYydBuK
lI8=
-----END CERTIFICATE-----`
	compresseedCertPEM = `-----BEGIN CERTIFICATE-----
MIIBjTCCATOgAwIBAgIUVh1OfSvgaa0UWkmj+lEHHM0NpXUwCgYIKoZIzj0EAwIw
RTELMAkGA1UEBhMCVVMxETAPBgNVBAgMCElsbGlub2lzMRAwDgYDVQQHDAdDaGlj
YWdvMREwDwYDVQQDDAh0ZXN0LmNvbTAeFw0yNTA1MDcwMTQ3NTlaFw0yNTA2MDYw
MTQ3NTlaMEUxCzAJBgNVBAYTAlVTMREwDwYDVQQIDAhJbGxpbm9pczEQMA4GA1UE
BwwHQ2hpY2FnbzERMA8GA1UEAwwIdGVzdC5jb20wOTATBgcqhkjOPQIBBggqhkjO
PQMBBwMiAALYPV13p9sfpR8CVYyZN4D/e3y43GdSeAH7M6lKGEvyR6MhMB8wHQYD
VR0OBBYEFLzZDxQYWg0n11niF+/Sf0XgBOkjMAoGCCqGSM49BAMCA0gAMEUCIQDc
wsiH7sydoFPblU4m3t4arxiU+qzLxlA4UnZgjHy+yQIgFV3g9Nm9ZLU7WO1ILr4O
IsJyCHajKtw8tI/qgxVV358=
-----END CERTIFICATE-----`
)

func parse(data string) (*x509.Certificate, error) {
	block, _ := pem.Decode([]byte(data))
	return x509.ParseCertificate(block.Bytes)
}

func main() {
	uncompressed, err := parse(uncompressedCertPEM)
	if err != nil {
		fmt.Printf("unexpected error parsing certificate with uncompressed public key, %+v\n", err)
		return
	}
	fmt.Printf("parsed certificate - uncompressed: %s\n", uncompressed.PublicKeyAlgorithm.String())
	compressed, err := parse((compresseedCertPEM))
	if err != nil {
		fmt.Printf("unexpected error parsing certificate with uncompressed public key, %+v\n", err)
		return
	}
	fmt.Printf("parsed certificate - uncompressed: %s\n", compressed.PublicKeyAlgorithm.String())
}

I'm also not certain if this is a feature request or a bug. But I can get working on something fairly quickly at this point.

[gopherbot]

Change https://go.dev/cl/670555 mentions this issue: crypto/x509: parse certificates with compressed EC pub keys

[austin-jadlowiec]

@sigmavirus24 Thank you very much for taking a look, and the CL!

IMO I would think with the citation of the "MAY" clause would mean this is a feature request, but I'll leave that up to you and the other maintainers to make that call.

Hope you have a good day

[sigmavirus24]

I'm no maintainer lol.

I'm just pointing it out because technically they have a distinction between proposal and bug.

Also, the CL would fix this for ParseCertificateRequest too which I was glad to see for other reasons.