Go version
1.26
Output of go env in your module/workspace:
AR='ar'
CC='cc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='c++'
GCCGO='gccgo'
GO111MODULE=''
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/home/pablo/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/home/pablo/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build4275791254=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/dev/null'
GOMODCACHE='/home/pablo/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/home/pablo/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/home/linuxbrew/.linuxbrew/Cellar/go/1.26.0/libexec'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/home/pablo/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/home/linuxbrew/.linuxbrew/Cellar/go/1.26.0/libexec/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'
What did you do?
https://go.dev/play/p/_iz6vpsen0r
What did you see happen?
x509.ParseCertificate rejects certificates containing BIT STRING (tag 3) in Distinguished Name attributes with:
x509: invalid RDNSequence: invalid attribute value: unsupported string type: 3
What did you expect to see?
x509.ParseCertificate should successfully parse certificates with BIT STRING (tag 3) and OCTET STRING (tag 4) values in RDN attributes, as these are valid encodings per X.520. For example, x500UniqueIdentifier (OID 2.5.4.45) is defined as BIT STRING in the spec.
OpenSSL parses these certificates without issues. Go's own x509.CreateCertificate correctly encodes BIT STRING attributes but ParseCertificate rejects them.
This affects real-world government-issued certificates. specifically, Polish KSeF (e-invoicing) certificates issued by the Ministry of Finance for non-Polish EU citizens.
Go version
1.26
Output of
go envin your module/workspace:What did you do?
https://go.dev/play/p/_iz6vpsen0r
What did you see happen?
x509.ParseCertificate rejects certificates containing BIT STRING (tag 3) in Distinguished Name attributes with:
x509: invalid RDNSequence: invalid attribute value: unsupported string type: 3What did you expect to see?
x509.ParseCertificate should successfully parse certificates with BIT STRING (tag 3) and OCTET STRING (tag 4) values in RDN attributes, as these are valid encodings per X.520. For example, x500UniqueIdentifier (OID 2.5.4.45) is defined as BIT STRING in the spec.
OpenSSL parses these certificates without issues. Go's own x509.CreateCertificate correctly encodes BIT STRING attributes but ParseCertificate rejects them.
This affects real-world government-issued certificates. specifically, Polish KSeF (e-invoicing) certificates issued by the Ministry of Finance for non-Polish EU citizens.