Go version
go version go1.24.9 linux/amd64
Output of go env in your module/workspace:
AR='ar'
CC='x86_64-linux-gnu-gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='x86_64-linux-gnu-g++'
GCCGO='gccgo'
GO111MODULE=''
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/tmp/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/tmp/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1131310259=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/dev/null'
GOMODCACHE='/tmp/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/tmp/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/lib/go-1.24'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/tmp/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/lib/go-1.24/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.9'
GOWORK=''
PKG_CONFIG='pkg-config'
What did you do?
In Debian, we've tested a rebuild of all packages at a given date in the future. The date is estimated to be three years after the release of our next stable distribution. The system clock of the building machine has been set to 2030-08-09. On that date, the smtp_test fails, because the certificate used for testing is no longer valid.
I've used openssl to show the contents of the localhostCert variable from net/smtp/smtp_test.go (line 1141):
$ openssl x509 -in cert.pem -noout -text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
f5:78:92:d6:dc:63:f9:a7:d2:84:51:8e:71:80:18:98
Signature Algorithm: sha256WithRSAEncryption
Issuer: O=Acme Co
Validity
Not Before: Mar 18 19:27:54 2025 GMT
Not After : Mar 18 19:27:54 2026 GMT
Subject: O=Acme Co
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:db:b0:47:e4:d5:b2:bb:a3:3c:19:95:c4:0c:f2:
b0:54:8a:40:b8:83:09:e7:c3:42:75:3d:49:46:0c:
6b:b5:63:ce:1d:2a:db:a5:6d:d5:a3:ca:b8:7c:f0:
3e:1f:49:db:66:c4:56:d7:13:b7:e1:61:42:53:06:
61:07:49:49:3d:38:b1:e1:fd:3a:fe:9d:20:b7:49:
f1:f4:23:ff:72:ea:5f:63:f6:f5:55:62:16:09:0b:
4e:d9:d6:66:59:29:56:fe:82:66:db:07:b2:c4:6a:
f1:8c:35:a1:47:8e:f4:49:03:00:57:d9:33:03:6d:
72:5c:79:9f:63:53:f8:a2:84:82:e4:65:ba:db:1b:
8d:2b:9f:59:9c:b5:85:66:71:1d:d8:a8:ec:c8:ff:
29:cb:8d:ef:7b:14:4b:f1:b6:c8:3d:f4:e5:23:cf:
35:f2:14:ca:9f:02:5d:09:dc:67:3a:b7:3b:c0:11:
1d:cd:fa:8b:ca:9e:e7:6c:9c:c0:79:63:e2:27:40:
71:e6:3d:e8:b3:1b:89:85:c9:e0:58:7a:c5:cd:c1:
7e:9c:98:8d:f4:73:c2:85:88:09:4a:1d:cb:31:8c:
9b:2e:a0:16:77:6d:2c:2f:bc:57:4a:da:19:ee:08:
ed:39:1c:48:02:cc:04:0a:52:56:3a:43:61:74:c4:
96:e5
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
X509v3 Extended Key Usage:
TLS Web Server Authentication
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Subject Alternative Name:
DNS:example.com, IP Address:127.0.0.1, IP Address:0:0:0:0:0:0:0:1
Signature Algorithm: sha256WithRSAEncryption
Signature Value:
67:7c:ee:25:61:15:d1:f4:07:4c:89:da:60:74:84:ea:30:42:
89:8a:4f:0c:bc:29:29:43:e1:0a:40:ba:b7:08:81:97:3e:de:
65:90:72:ec:ca:c6:c5:f5:fd:d5:c6:2a:0a:35:8c:e4:6a:42:
46:54:6c:ae:e7:58:6a:ca:11:aa:19:0e:0c:ec:8a:4e:05:09:
26:63:6e:08:13:15:8f:54:49:36:c2:42:15:f8:74:d4:fa:84:
15:64:e2:2b:1c:5f:ac:f4:82:05:38:88:77:48:83:c8:b1:73:
6f:c7:ba:d4:73:9b:20:17:83:fe:78:09:c0:72:fd:e8:d7:32:
fb:62:31:89:67:c7:b6:ec:08:b6:b8:5f:22:1b:fa:68:ff:45:
5d:f7:73:92:07:c4:e3:fc:db:e0:f7:d4:92:b9:cc:bb:9c:16:
13:ad:e4:9d:85:48:d9:59:12:34:5b:5a:18:25:7e:3d:fd:f8:
56:96:34:7d:f3:e7:f6:1a:a5:1f:2d:ce:e2:0a:37:15:df:0c:
65:7c:1a:84:28:27:69:8d:7b:22:aa:db:1b:d4:aa:c0:c7:b0:
04:3a:3e:d7:7c:38:c9:8f:20:8b:e1:bb:21:2e:9f:71:3d:b5:
7e:90:11:42:37:5e:75:89:66:2d:7f:38:4a:12:99:6b:64:56:
0d:5e:55:f6So the certificate will expire on Mar 18 19:27:54 2026 GMT, about a month from now.
This bug is not limited to go 1.24, but also present in 1.25 and 1.26. For Debian, I've created a new localhost certificate with the command mentioned in the comment above the variable definition:
go run generate_cert.go --rsa-bits 2048 --host 127.0.0.1,::1,example.com \
--ca --start-date "Jan 1 00:00:00 1970" --duration=1000000h
This creates a certificate valid until Jan 29 16:00:00 2084 GMT, which should be long enough.
What did you see happen?
The smtp_test fails.
What did you expect to see?
A passing smtp_test.
Go version
go version go1.24.9 linux/amd64
Output of
go envin your module/workspace:What did you do?
In Debian, we've tested a rebuild of all packages at a given date in the future. The date is estimated to be three years after the release of our next stable distribution. The system clock of the building machine has been set to 2030-08-09. On that date, the smtp_test fails, because the certificate used for testing is no longer valid.
I've used
opensslto show the contents of thelocalhostCertvariable fromnet/smtp/smtp_test.go(line 1141):$ openssl x509 -in cert.pem -noout -text Certificate: Data: Version: 3 (0x2) Serial Number: f5:78:92:d6:dc:63:f9:a7:d2:84:51:8e:71:80:18:98 Signature Algorithm: sha256WithRSAEncryption Issuer: O=Acme Co Validity Not Before: Mar 18 19:27:54 2025 GMT Not After : Mar 18 19:27:54 2026 GMT Subject: O=Acme Co Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:db:b0:47:e4:d5:b2:bb:a3:3c:19:95:c4:0c:f2: b0:54:8a:40:b8:83:09:e7:c3:42:75:3d:49:46:0c: 6b:b5:63:ce:1d:2a:db:a5:6d:d5:a3:ca:b8:7c:f0: 3e:1f:49:db:66:c4:56:d7:13:b7:e1:61:42:53:06: 61:07:49:49:3d:38:b1:e1:fd:3a:fe:9d:20:b7:49: f1:f4:23:ff:72:ea:5f:63:f6:f5:55:62:16:09:0b: 4e:d9:d6:66:59:29:56:fe:82:66:db:07:b2:c4:6a: f1:8c:35:a1:47:8e:f4:49:03:00:57:d9:33:03:6d: 72:5c:79:9f:63:53:f8:a2:84:82:e4:65:ba:db:1b: 8d:2b:9f:59:9c:b5:85:66:71:1d:d8:a8:ec:c8:ff: 29:cb:8d:ef:7b:14:4b:f1:b6:c8:3d:f4:e5:23:cf: 35:f2:14:ca:9f:02:5d:09:dc:67:3a:b7:3b:c0:11: 1d:cd:fa:8b:ca:9e:e7:6c:9c:c0:79:63:e2:27:40: 71:e6:3d:e8:b3:1b:89:85:c9:e0:58:7a:c5:cd:c1: 7e:9c:98:8d:f4:73:c2:85:88:09:4a:1d:cb:31:8c: 9b:2e:a0:16:77:6d:2c:2f:bc:57:4a:da:19:ee:08: ed:39:1c:48:02:cc:04:0a:52:56:3a:43:61:74:c4: 96:e5 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Key Usage: critical Digital Signature, Key Encipherment X509v3 Extended Key Usage: TLS Web Server Authentication X509v3 Basic Constraints: critical CA:FALSE X509v3 Subject Alternative Name: DNS:example.com, IP Address:127.0.0.1, IP Address:0:0:0:0:0:0:0:1 Signature Algorithm: sha256WithRSAEncryption Signature Value: 67:7c:ee:25:61:15:d1:f4:07:4c:89:da:60:74:84:ea:30:42: 89:8a:4f:0c:bc:29:29:43:e1:0a:40:ba:b7:08:81:97:3e:de: 65:90:72:ec:ca:c6:c5:f5:fd:d5:c6:2a:0a:35:8c:e4:6a:42: 46:54:6c:ae:e7:58:6a:ca:11:aa:19:0e:0c:ec:8a:4e:05:09: 26:63:6e:08:13:15:8f:54:49:36:c2:42:15:f8:74:d4:fa:84: 15:64:e2:2b:1c:5f:ac:f4:82:05:38:88:77:48:83:c8:b1:73: 6f:c7:ba:d4:73:9b:20:17:83:fe:78:09:c0:72:fd:e8:d7:32: fb:62:31:89:67:c7:b6:ec:08:b6:b8:5f:22:1b:fa:68:ff:45: 5d:f7:73:92:07:c4:e3:fc:db:e0:f7:d4:92:b9:cc:bb:9c:16: 13:ad:e4:9d:85:48:d9:59:12:34:5b:5a:18:25:7e:3d:fd:f8: 56:96:34:7d:f3:e7:f6:1a:a5:1f:2d:ce:e2:0a:37:15:df:0c: 65:7c:1a:84:28:27:69:8d:7b:22:aa:db:1b:d4:aa:c0:c7:b0: 04:3a:3e:d7:7c:38:c9:8f:20:8b:e1:bb:21:2e:9f:71:3d:b5: 7e:90:11:42:37:5e:75:89:66:2d:7f:38:4a:12:99:6b:64:56: 0d:5e:55:f6So the certificate will expire on Mar 18 19:27:54 2026 GMT, about a month from now.
This bug is not limited to go 1.24, but also present in 1.25 and 1.26. For Debian, I've created a new localhost certificate with the command mentioned in the comment above the variable definition:
This creates a certificate valid until Jan 29 16:00:00 2084 GMT, which should be long enough.
What did you see happen?
The smtp_test fails.
What did you expect to see?
A passing smtp_test.