Repository navigation
crypto/x509: clarify VerifyOptions.CertificatePolicies semantics #81502
Description
The documentation for VerifyOptions.CertificatePolicies should clarify that it supplies the acceptable policy set for policy processing, but does not by itself require a matching policy to be present. An otherwise valid chain may verify with no matching policy, or no certificatePolicies extension, unless explicit policy is required by the chain. A successful Verify result with this option alone is therefore not evidence that a requested policy was present.
Details
In src/crypto/x509/verify.go, the pure-Go verifier filters candidate chains through policiesValid. That function initializes explicitPolicy to n + 1 unless the unexported testing-only opts.requireExplicitPolicy flag is set.
The supplied OIDs populate initialUserPolicySet and participate in the final intersection, but an empty result is rejected only when explicitPolicy == 0. A CA's requireExplicitPolicy policyConstraints field can reduce that counter; setting the public CertificatePolicies field does not itself do so.
A documentation example could request OID 1.2.3.5 and explain why an otherwise valid chain with only policy 1.2.3.4, or no policy extension, can still verify when explicit policy is not required. Platform verification on Windows, macOS, and iOS also has early returns before this pure-Go filter; the documentation should make the scope of policy processing on those paths clear rather than implying a uniform application-level allowlist.
This is a clarification of existing behavior, not a request to make nonempty CertificatePolicies require explicit policy.
This issue was found by zkao and was triaged by @FiloSottile as intended behavior but an opportunity to improve documentation. /cc @golang/security
Activity
gabyhelp commentedon Sep 13, 2026
Related Issues
Related Code Changes
(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)
gopherbot commentedon Sep 14, 2026
Change https://go.dev/cl/832566 mentions this issue:
crypto/x509: clarify VerifyOptions.CertificatePolicies semantics