Repository navigation
crypto/x509: document duplicate handling in CertPool.AddCertWithConstraint #81500
Description
The documentation for CertPool.AddCertWithConstraint should clarify that adding a certificate already present in the pool is a no-op, including for its constraint. The first insertion determines the stored constraint: a later addition neither attaches a constraint to an unconstrained entry nor replaces or combines existing constraints.
pool.AddCert(ca)
pool.AddCertWithConstraint(ca, rejectingConstraint) // no-op; ca remains unconstrainedDetails
The shared insertion helper in src/crypto/x509/cert_pool.go checks s.haveSum[rawSum224] and returns before storing the supplied constraint. Deduplication is by certificate DER hash, not merely subject or public key. Both AddCert and AppendCertsFromPEM insert entries with nil constraints.
When verifying a chain, findPotentialParents retrieves the stored constraint, so buildChains has no callback to invoke for an unconstrained root even if a later duplicate addition supplied one. An otherwise valid chain rooted there remains eligible.
The method documentation describes callback evaluation but not duplicate handling.
This issue was found by zkao and was triaged by @FiloSottile as intended behavior but an opportunity to improve documentation. /cc @golang/security
Activity
gabyhelp commentedon Sep 13, 2026
Related Issues
(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)
gopherbot commentedon Sep 14, 2026
Change https://go.dev/cl/832564 mentions this issue:
crypto/x509: document CertPool duplicate AddCert handling