Description
CreateCertificate accepts a caller-supplied template.SerialNumber equal to zero. Nil serial numbers are now automatically generated as conformant positive serials, but an explicit big.NewInt(0) is still accepted.
This is a generation/profile issue. It does not show a verification bypass or trust-boundary violation by itself.
Specification
RFC 5280 Section 4.1.2.2 requires the certificate serial number to be a positive integer assigned by the CA to each certificate.
Code references
go/src/crypto/x509/x509.go:1813 loads template.SerialNumber.go/src/crypto/x509/x509.go:1814 through go/src/crypto/x509/x509.go:1828 generates a conformant serial only when the field is nil.go/src/crypto/x509/x509.go:1830 documents the positive-serial requirement.go/src/crypto/x509/x509.go:1835 rejects only Sign() == -1, so Sign() == 0 is accepted.
Test case
This should be a Go in-tree crypto/x509 API regression test: call CreateCertificate with SerialNumber: big.NewInt(0) and assert that it returns x509: serial number must be positive.
Description
CreateCertificateaccepts a caller-suppliedtemplate.SerialNumberequal to zero. Nil serial numbers are now automatically generated as conformant positive serials, but an explicitbig.NewInt(0)is still accepted.This is a generation/profile issue. It does not show a verification bypass or trust-boundary violation by itself.
Specification
RFC 5280 Section 4.1.2.2 requires the certificate serial number to be a positive integer assigned by the CA to each certificate.
Code references
go/src/crypto/x509/x509.go:1813loadstemplate.SerialNumber.go/src/crypto/x509/x509.go:1814throughgo/src/crypto/x509/x509.go:1828generates a conformant serial only when the field is nil.go/src/crypto/x509/x509.go:1830documents the positive-serial requirement.go/src/crypto/x509/x509.go:1835rejects onlySign() == -1, soSign() == 0is accepted.Test case
This should be a Go in-tree
crypto/x509API regression test: callCreateCertificatewithSerialNumber: big.NewInt(0)and assert that it returnsx509: serial number must be positive.