crypto/tls: revert Config.Clone change and apply lightweight chain validation

[rolandshoemaker]

Spinning this off #77217 for clean handling of backport issues.

As an update to the fix for CVE-2025-68121, which caused regressions for some large users, we will revert the change to Config.Clone, and implement a follow-up fix which does lightweight verified chain validation to prevent reuse of session tickets across Configs with different Roots.

[rolandshoemaker]

@gopherbot please open backport issues for 1.24, 1.25, and 1.26.

[gopherbot]

Backport issue(s) opened: #77355 (for 1.24), #77356 (for 1.25), #77357 (for 1.26).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

[gabyhelp]

Related Issues

• crypto/tls: revert Config.Clone change and apply lightweight chain validation [1.25 backport] #77356
• crypto/tls: revert Config.Clone change and apply lightweight chain validation [1.24 backport] #77355
• crypto/tls: revert Config.Clone change and apply lightweight chain validation [1.26 backport] #77357
• crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does not account for the expiration of full certificate chain (CVE-2025-68121) #77113 (closed)
• crypto/tls: certificate chains aren't re-checked on resumption #77217
• crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does not account for the expiration of full certificate chain (CVE-2025-68121) [1.25 backport] #77115 (closed)
• crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does not account for the expiration of full certificate chain (CVE-2025-68121) [1.24 backport] #77114 (closed)

Related Code Changes

• [release-branch.go1.25] crypto/tls: don't copy auto-rotated session ticket keys in Config.Clone
• [release-branch.go1.24] crypto/tls: don't copy auto-rotated session ticket keys in Config.Clone
• [release-branch.go1.26] crypto/tls: don't copy auto-rotated session ticket keys in Config.Clone

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[rolandshoemaker]

Backports have all landed, nothing left to do on master so closing.

[rbqvq]

The following is a message from an BugHunter ticket at February 28th. I'm not sure if they relayed it here (since there's no correction yet, I assume they didn't).

Since this is not a product bug, I did not open a new issue.

---

serverConfig.Certificates = []Certificate{{
    Certificate: [][]byte{initialLeafDER, expiredLeafDER},
    PrivateKey: testECDSAPrivateKey,
}}

See https://github.com/golang/go/blob/master/src/crypto/tls/handshake_server_test.go#L2213

According to the RFC specification, the correct certificate chain to send should be [Leaf][Intermediate...] (excluding the root certificate).

However, the test suite's certificate chain is [Leaf][ExpiredLeaf].

Its ExpiredLeaf does not satisfy the IsCA constraint for Intermediate, and ultimately, the verifiedChains of the Session Ticket do not contain ExpiredLeaf.

Therefore, we are not testing the possibility of multiple chains having partially expired chain in the resumption; we are testing whether the x509 validator can handle malformed certificate chains.

The correct approach would be to test the cross-signing of root/intermediate certificates.

I have provided the code snippet in the attachment for reference or direct use.

---

The snippet

func testHandshakeChainExpiryResumption(t *testing.T, version uint16) {
	now := time.Now()

	createChain := func(leafNotAfter, intermediateNotAfter, rootNotAfter time.Time) (leafDER []byte, intermediate, root *x509.Certificate) {
		tmpl := &x509.Certificate{
			Subject:               pkix.Name{CommonName: "root"},
			NotBefore:             now.Add(-time.Hour * 24),
			NotAfter:              rootNotAfter,
			IsCA:                  true,
			BasicConstraintsValid: true,
		}
		rootDER, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &testECDSAPrivateKey.PublicKey, testECDSAPrivateKey)
		if err != nil {
			t.Fatalf("CreateCertificate: %v", err)
		}
		root, err = x509.ParseCertificate(rootDER)
		if err != nil {
			t.Fatalf("ParseCertificate: %v", err)
		}

		tmpl = &x509.Certificate{
			Subject:               pkix.Name{CommonName: "intermediate"},
			NotBefore:             now.Add(-time.Hour * 24),
			NotAfter:              intermediateNotAfter,
			IsCA:                  true,
			BasicConstraintsValid: true,
		}
		intermediateDER, err := x509.CreateCertificate(rand.Reader, tmpl, root, &testECDSAPrivateKey.PublicKey, testECDSAPrivateKey)
		if err != nil {
			t.Fatalf("CreateCertificate: %v", err)
		}
		intermediate, err = x509.ParseCertificate(intermediateDER)
		if err != nil {
			t.Fatalf("ParseCertificate: %v", err)
		}

		tmpl = &x509.Certificate{
			Subject:   pkix.Name{},
			DNSNames:  []string{"expired-resume.example.com"},
			NotBefore: now.Add(-time.Hour * 24),
			NotAfter:  leafNotAfter,
			KeyUsage:  x509.KeyUsageDigitalSignature,
		}
		leafCertDER, err := x509.CreateCertificate(rand.Reader, tmpl, intermediate, &testECDSAPrivateKey.PublicKey, testECDSAPrivateKey)
		if err != nil {
			t.Fatalf("CreateCertificate: %v", err)
		}

		return leafCertDER, intermediate, root
	}
	testExpiration := func(name string, expireIntermediate bool) {
		t.Run(name, func(t *testing.T) {
			leafNotAfter := now.Add(3 * time.Hour)
			intermediateNotAfter := now.Add(4 * time.Hour)
			rootNotAfter := now.Add(time.Hour)

			expiredRoot := rootNotAfter.Add(time.Minute)
			expiredNow := leafNotAfter.Add(time.Minute)
			if expireIntermediate {
				intermediateNotAfter = now.Add(2 * time.Hour)
				expiredNow = intermediateNotAfter.Add(time.Minute)
			}

			initialLeafDER, intermediateRoot, initialRoot := createChain(leafNotAfter, intermediateNotAfter, rootNotAfter)

			serverConfig := testConfig.Clone()
			serverConfig.MaxVersion = version
			serverConfig.Certificates = []Certificate{{
				Certificate: [][]byte{initialLeafDER, intermediateRoot.Raw},
				PrivateKey:  testECDSAPrivateKey,
			}}
			serverConfig.ClientCAs = x509.NewCertPool()
			serverConfig.ClientCAs.AddCert(initialRoot)
			serverConfig.ClientCAs.AddCert(intermediateRoot)
			serverConfig.ClientAuth = RequireAndVerifyClientCert
			serverConfig.Time = func() time.Time {
				return now
			}
			serverConfig.InsecureSkipVerify = false
			serverConfig.ServerName = "expired-resume.example.com"

			clientConfig := testConfig.Clone()
			clientConfig.MaxVersion = version
			clientConfig.Certificates = []Certificate{{
				Certificate: [][]byte{initialLeafDER, intermediateRoot.Raw},
				PrivateKey:  testECDSAPrivateKey,
			}}
			clientConfig.RootCAs = x509.NewCertPool()
			clientConfig.RootCAs.AddCert(initialRoot)
			clientConfig.RootCAs.AddCert(intermediateRoot)
			clientConfig.ServerName = "expired-resume.example.com"
			clientConfig.ClientSessionCache = NewLRUClientSessionCache(32)
			clientConfig.InsecureSkipVerify = false
			clientConfig.ServerName = "expired-resume.example.com"
			clientConfig.Time = func() time.Time {
				return now
			}

			testResume := func(t *testing.T, sc, cc *Config, expectResume bool) {
				t.Helper()
				ss, cs, err := testHandshake(t, cc, sc)
				if err != nil {
					t.Fatalf("handshake: %v", err)
				}
				if cs.DidResume != expectResume {
					t.Fatalf("DidResume = %v; want %v", cs.DidResume, expectResume)
				}
				if ss.DidResume != expectResume {
					t.Fatalf("DidResume = %v; want %v", cs.DidResume, expectResume)
				}
			}

			testResume(t, serverConfig, clientConfig, false)
			testResume(t, serverConfig, clientConfig, true)

			serverConfig.Time = func() time.Time {
				return expiredRoot
			}
			testResume(t, serverConfig, clientConfig, true)

			freshLeafDER, freshIntermediateRoot, freshRoot := createChain(expiredNow.Add(time.Hour), expiredNow.Add(time.Hour), expiredNow.Add(time.Hour))
			clientConfig.Certificates = []Certificate{{
				Certificate: [][]byte{freshLeafDER, freshIntermediateRoot.Raw},
				PrivateKey:  testECDSAPrivateKey,
			}}
			serverConfig.Time = func() time.Time {
				return expiredNow
			}
			serverConfig.ClientCAs = x509.NewCertPool()
			serverConfig.ClientCAs.AddCert(freshRoot)
			serverConfig.ClientCAs.AddCert(freshIntermediateRoot)

			testResume(t, serverConfig, clientConfig, false)
		})
	}

	testExpiration("LeafExpiresBeforeRoot", false)
	testExpiration("LeafExpiresAfterRoot", true)
}