crypto/x509: ParseRevocationList accepts the IDP extension with DER encoding as an empty sequence

[onepeople158]

Go version

go version go1.24.2 linux/amd64

Output of go env in your module/workspace:

IDP Extension Flags:
 Only Contains User Certificates: false
 Only Contains CA Certificates: false
 Indirect CRL: false

What did you do?

Hello Developer,

RFC5280 specifies that if onlyContainsUserCerts, onlyContainsCACerts, indirectCRL, and OnlyContainsAttributeCerts are all FALSE, there must be either a distributionPoint field or an onlySomeReasons field present.

However, when I am using Go to parse a CRL file, this CRL file has onlyContainsUserCerts, onlyContainsCACerts, indirectCRL, and OnlyContainsAttributeCerts all set to FALSE, and it does not have a distributionPoint field or an onlySomeReasons field. Go does not throw an error. Is this a bug, or is it a feature of Go?

What did you see happen?

Go parses the IDP extension information with a DER encoding of an empty sequence.

What did you expect to see?

crl_IDP_None.zip

[gabyhelp]

Related Issues

• crypto/x509: certificate with empty Authority Key Identifier extension considered invalid #70619
• crypto/x509: accepts DN with all empty values #73021

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[dmitshur]

CC @golang/security.